#1 2022-11-11 9:39 pm

DLipman

Member

Registered: 2020-10-27

Posts: 22

Tried to submit a person who used a Clouflare IP and got an error

We had a person who tried to do a XSS penetration test (w/o permission) violating Forum guidelines.

I tried to submit the member but I could not.  The record could not be added.  It did not like the CloudFlare IP used in the action and the submission failed.

"IP ADDRESS CAN NOT BE ADDED [CLOUDFLARE]"

104.28.213.2 - Shubra al Khaymah, Qalyubia, Egypt   
ISP - CloudFlare, Organization- CloudFlare

Alex Kemp

Moderator

From: Nottingham, England

Registered: 2009-12-02

Posts: 2,422

Website

Re: Tried to submit a person who used a Clouflare IP and got an error

Hi DLipman, welcome to SFS.

You need to obtain the original public IP of the visitor, else you are currently attempting to prevent several thousand (or even hundreds of thousands) of innocent people that are using the same CloudFlare service.

Here is just one page that I found offering methods to do that:
Restoring original Visitor IPs.

Obviously, the method that you use depends on your site situation, but the fundamental policy remains the same for all situations: you have to obtain the *actual* public IP of a visitor, not the forwarding IP, etc., etc.. If you are using forum software, then you need to refer to the software writer to get this right, since your software is currently broken due to using wrongful algorithms for IP acquisition.

HTH

---

Alex Kemp

IP Aggregation (Help) · Easy Firewall Generator (Help)  · Conteg v0.13.14

DLipman

Member

Registered: 2020-10-27

Posts: 22

Re: Tried to submit a person who used a Clouflare IP and got an error

Obrigado.

In my opinion the IP is not as important as the email address used and to a lesser degree the account name.

However, the IP denial construct blocks both of them too.

Is there a way to make the submission and get around this?

DLipman

Member

Registered: 2020-10-27

Posts: 22

Re: Tried to submit a person who used a Clouflare IP and got an error

PS:
The broken software is Invison

Maikuolan

Member

From: Perth, Western Australia

Registered: 2011-08-09

Posts: 799

Website

Re: Tried to submit a person who used a Clouflare IP and got an error

I would point out that, although yes, an XSS attack or penetration test without permission is a bad thing, and should definitely be blocked (at the websites in question), it is not a form of spam, and thus, is not a suitable reason for submitting data here to SFS.

There are plenty of databases, blocklists, etc publicly available which cater to hacking, security breaches, and other kinds of bad behaviour more broadly, to which it would be suitable to submit such data. But the SFS database is intended just for dealing with forum spam only.

Last edited by Maikuolan (2022-11-12 3:12 am)

Alex Kemp

Moderator

From: Nottingham, England

Registered: 2009-12-02

Posts: 2,422

Website

Re: Tried to submit a person who used a Clouflare IP and got an error

To echo Maikuolan, you can NOT submit someone that has done anything other than spam your site. No spam, no submission.

In addition, software reporting wrong IPs with Cloudflare users is a classic mistake of older software. You need to fix that for your own sake. If the software is still being maintained then it will (hopefully) have been updated.

Finally, obtaining the correct Public IP is a *requirement* as part of submitting spammers to this site.

---

Alex Kemp

IP Aggregation (Help) · Easy Firewall Generator (Help)  · Conteg v0.13.14

Oblivian

Member

Registered: 2018-11-04

Posts: 79

Re: Tried to submit a person who used a Clouflare IP and got an error

It also wasn't hard to find on google.
2nd hit is their support forums.

"Turning on the "Trust IP Addresses provided by proxies" would enable it to show the real users IP address. So it is the answer to obtaining the real user's IP address."

DLipman

Member

Registered: 2020-10-27

Posts: 22

Re: Tried to submit a person who used a Clouflare IP and got an error

Domo arigato

webeditor

Member

Registered: 2021-08-29

Posts: 6

Re: Tried to submit a person who used a Clouflare IP and got an error

Just had something similar. Russian IP address 104.28.198.247 that is showing up on another anti-spam database but can't be reported here. Have evidence too ...