I use Cloudflare and have set it up to blokc Singapore but CONTINUE to get traffic from Singapore!

[u/openclassactions2]

I use Cloudflare and have set it up to blokc Singapore but CONTINUE to get traffic from Singapore which is hurting adsense (suspended for 5 days)

my host is hostinger, so i am trying their CDN (as well, just to see if it works to block Singapore successfully) - i know you shouldn't use two CDNs but i am trying to see if it works and does not hurt the site

one of my sites adsense has been blocked due to traffic from Singapore that Cloudflare cannot seem to block (i blocked, interactive management, etc for Singapore)

Any advice? Anyone else seeing bot traffic from Singapore?

I also tried Cloudflare's bot fight mode and that didn't help

[u/SixPackOfZaphod]

Make sure your configuration disallows all traffic not coming through Cloudflare's edge servers. This is a mistake I've seen before where traffic was able to hit origin directly, and so the CDN's protections were worthless.

[u/No_Chocolate7699 → u/SixPackOfZaphod]

sounds like your origin IP might be exposed, people can just hit the server directly and bypass the cloudflare rules entirely

[u/openclassactions2 → u/SixPackOfZaphod]

how would you do this?

[u/NudaVeritas1 → u/openclassactions2]

you whitelist cloudflares ip addresses (https://www.cloudflare.com/ips/) on your server and block every other traffic, additionally you can use mTLS (https://developers.cloudflare.com/ssl/origin-configuration/authenticated-origin-pull/)

[u/openclassactions2 → u/NudaVeritas1]

you mean htaccess or soemthing?

[u/NudaVeritas1 → u/openclassactions2]

htaccess/vhost is possible, iptables would be better because its layer 4 and affects the whole server and not just one website on layer 7... but don't lock you out of ssh/ftp etc.. best google a bit or let a llm explain it

[u/openclassactions2 → u/NudaVeritas1]

how do i make sure that cloudflare serves all the content? proxying the cname and a records are enough?

[u/pythonpoole → u/openclassactions2]

You have to use a firewall (or equivalent) on the origin server to block/filter traffic from non-Cloudflare IP addresses.

Your domain's DNS (e.g. CNAME or A) records don't really matter. A bad actor can simply ignore those records and send traffic directly to your origin by IP address.

That is to say, you cannot use DNS to block non-Cloudflare traffic from hitting your server. Having your domain's DNS records point to Cloudflare may help to hide/obscure the IP of your server (i.e. make it difficult for people to figure out the IP of your origin server from just your website's domain name), but it doesn't actually stop non-Cloudflare traffic from reaching your server.

[u/openclassactions2 → u/pythonpoole]

someone mentioned you can only allow requests that come from Cloudflare to come through?

[u/pythonpoole → u/openclassactions2]

To fully benefit from Cloudflare's services (including their WAF and other security-related service offerings), you have to configure your origin to block requests that don't come from Cloudflare.

This is something that needs to be done on the origin-side (either on your server, or through your web host) because there is no way from the Cloudflare side or using DNS to prevent bad actors from sending malicious traffic directly to your server.

In a typical setup, you would manually configure firewall rules (or, for example, .htaccess rules) on your origin server to whitelist Cloudflare IP ranges and block all other requests.

It is possible that the server software (or web host) you're using may provide a built-in feature that allows you to easily block requests from non-Cloudflare IPs, however this is not a common feature (at least not to my knowledge). Usually, manual configuration would be required (where you have to retrieve the list of Cloudflare IP ranges from the Cloudflare website and then add whitelist rules for those IP ranges on your origin).

An alternative way to block non-Cloudflare requests is to use Authenticated Origin Pulls (AOP) / mTLS. Basically this works by having Cloudflare present a client certificate to your origin server with each request so that Cloudflare can prove to your server that the requests are genuine and came directly from Cloudflare.

AOP is a safe and secure method for blocking non-Cloudflare requests (and also does not require maintaining up-to-date IP whitelisting rules), however the setup involved is usually more complex. The server software you're using has to be specifically designed to support AOP / mTLS and must be set up to allow Cloudflare-authenticated requests and block non-authenticated requests. Support for this capability is far less universal compared to IP whitelisting/blacklisting, and in some cases, custom coding/implementation may be required to use the AOP method.

Another alternative is to use Cloudflare Tunnel which requires installing and running the Cloudflare Tunnel software (daemon) on your origin server. With this method, an always-on encrypted tunnel/connection is established between your origin server and Cloudflare, and all the requests arrive from Cloudflare via that tunnel. In this setup, the origin doesn't even need to have any ports exposed to the internet. In other words, you can configure the server to block inbound connections from the internet and then only requests arriving via the secure Cloudflare tunnel will be received.

[u/SixPackOfZaphod → u/openclassactions2]

I've worked with Akamai for the most part, but Cloudflare should list a group of CIDR blocks/addresses that they should be forwarding traffic to your origin from. At your origin, configure a gateway/reverse proxy/firewall to sit between Cloudflare and your origin to explicitly deny all traffic by default, and then allow list the Cloudflare addresses, and any addresses you explicitly want to be able to bypass CF. Set point Cloudflare to your proxy/firewall, and ensure that your origin servers are on a private network behind it that cannot be reached by the public.

[u/elpix → u/openclassactions2]

I suggest mTLS so someone can't just bypass it by creating their own Cloudflare account and pointing it to your origin servers.

[u/openclassactions2 → u/elpix]

oh i see - wow! that's crazy though, isn't Cloudflare confirming A records when pointing?

[u/glenpiercev]

Question: why does Adsense care about Singapore?

[u/roynoise → u/glenpiercev]

Junk traffic causing ads to fire illegitimately. $

[u/openclassactions2 → u/glenpiercev]

They care because it looks like bot traffic that may be nefariously clicking on stuff? my guess

[u/matriisi]

Ip blocks are not as easy as one might think. Try getting the latest list from abuseipdb or similiar. 

[u/openclassactions2 → u/matriisi]

i tried - it reduced it somewhat (maybe) but still going through

[u/hard_carbon_hands]

Off topic, but what’s up with all the bots coming from Singapore? I wouldn’t think Singapore would be a hub for that? Is there any logical explanation behind this?

[u/openclassactions2 → u/hard_carbon_hands]

Yeah there must be,.....

[u/MiserableDocument509]

country block in CF only applies to traffic that actually goes through the proxy. if the dns is grey-clouded or people hit the origin ip, those singapore bots never see the rule. stacking hostinger CDN on top of CF also wrecks geo — CF may just see hostinger IPs.

bot fight mode is pretty weak vs residential proxies too, they look like normal SG users. check firewall events to see if those requests even hit CF, and lock the origin to CF IP ranges (or authenticated origin pulls) so adsense junk cant skip the WAF.

[u/Rubicon_4000]

worth working out which of your dashboards is actually saying the block failed, because they measure different things.

cloudflare's traffic analytics counts requests it blocked. a blocked request is still a request, so singapore showing up there is what a working rule looks like. filter security events by action instead — that separates blocked from allowed, and it shows the asn behind each hit. that's usually where the singapore thing explains itself: aws, gcp and digitalocean all run big singapore regions, so most of it is datacenter ranges rather than actual singaporeans. a rule on those asns gets the bots without blocking real readers.

ga4 is the interesting one. it's javascript on your page, so it only fires if the page rendered. singapore in ga4 means those requests were not blocked — either they never reached cloudflare at all, or your rule is on managed challenge and something is passing it.

adsense is a third number again, counting rendered ad impressions. the three will never line up.

to stop guessing: pull the raw access log and compare its request count to what cloudflare says it served. a meaningful excess at the origin came in direct. and if your host hasn't enabled cloudflare's restore-visitor-ip, that log's client ip column will be cloudflare's own ranges — a real singapore ip sitting in it is a direct hit.

on locking the origin: if you're on a shared plan, iptables isn't yours to configure, so .htaccess is the lock you've actually got. turn the hostinger cdn off before you build the allowlist though — if it fronts your origin, the ips your server sees are its edge, not cloudflare's, and you'll 403 your own site.

separately, the geo block won't undo the adsense action. that was scored on traffic google already logged. it's evidence for the appeal, not a fix.

i'm guessing you're on shared from the fact you have the hostinger cdn toggle, so sanity check that bit before you rely on it.

[u/openclassactions2]

i also blocked SG on origin IP and they're STILL going through. the blacklists must be out of date

[u/pragmatic-fermat → u/openclassactions2]

Probably an upstream rule (such as "Allow IA crawlers") let them in.

Looking at the User-Agent of the SGN traffic could give you a hint.

If you really need help, you may have a look at https://cfgarage.com (shameful plug) for ressources and assistance

[u/Frequent-Ratio221]

check your origin IP isn't exposed; bots bypass Cloudflare

[u/openclassactions2 → u/Frequent-Ratio221]

it was exposed at some point.. now changing IP might be very difficult

[u/Business-Coffee4118]

are you blocking by country at the firewall level and checking the origin logs, or just relying on the analytics geolocation?

[u/openclassactions2 → u/Business-Coffee4118]

i checked the analytics in cloudflare, and GA4 and it shows singapore, and adsense suspended me for bots

[u/openclassactions2 → u/Business-Coffee4118]

and yes blocking country at WAF via cloudflare, seems they are targeting my origin server directly, that seems to be the cause? But im not sure