Hacker News Reader

Comment by acdha | Hacker News Reader

Did you have problems with malware, or something like uBlock installed? Normally you won’t see issues with shared IPs unless there’s something unusual about your traffic.

View on HN

Simply having a lot of traffic with differing user-agents/TCP/TLS stacks (yes, CF does fingerprint those too) will often look like a proxy and trigger captchas, even if there's nothing actually malicious about the traffic itself. I guess CF manually maintains lists of known NAT exit IPs to relax these restrictions for major carrier-grade NATs (mobile networks, etc) as they'd have the same problem otherwise.

They also do a lot of things to identify discrete real users - I asked because normally it’s not as simple as a NAT triggering this, especially once people establish reputation within a session. I’ve had multiple times where someone reported that as a problem for our sites and then investigated and found that they did have a system with malware, or a browser extension changing their behavior enough to look like a bot.

>or a browser extension changing their behavior enough to look like a bot.

You run privacybadger? To CF purgatory for you!

Having uBlock installed can't be "something unusual" in this day and age, can it?

That depends on the configuration, but it’s definitely not common for general sites. The original poster mentioned captchas and that’s what I’d expect if you block cookies and JavaScript because there “is this a real browser?” tests use those to avoid hitting people with prompts when they look like a standard browser in its default configuration.

I sometimes forget I have my VPN on and don't ever realize until I randomly hit a captcha or youtube tells me I'm in a different country. I'm surprised so many people are getting these because I can go hours without seeing one with my VPN on. I not only have ublock but other privacy things which cause more problems (cookies) than captchas.

I used Firefox and might have installed uBlock. I wasn't the only one with this issue, it was a general complaint within the department.

I have bad news for your colleagues at $previousJob.

There was likely botnet activity in the network - on the users' machines connected through the VPN - triggering anti-DDoS protections.

I’m sure it happened - I just asked because a fair percentage of the time when I get a report like that and investigate with our CDN logs it turns out that they have something like a corporate proxy or browser extension which breaks some bot heuristic looking for standard browsers.

Reply on news.ycombinator.com