Nearly 90% of HTTP attacks on our website come from Cloudflare Workers. We've chosen to block huge subnets of their IPs because of it.
This new raw TCP connection feature will undoubtedly be used to attack other services in similar ways.
This new raw TCP connection feature will undoubtedly be used to attack other services in similar ways.
Cloudflare has (had?) a murky history with not taking down DDoS for hire services ironically hosted behind cloudflare. But while you could argue they had an incentive to do that (sell protection), I can't think of any incentive to let Workers be abused.
Trivial based on the fact that HTTP requests coming from CloudFlare Workers has a cf-worker header. Also, any traffic coming from cloudflare-owned IP blocks clearly belongs to cloudflare and can be safely blocked.
Cloudflare reserves IP ranges just for Private Relay: https://developer.apple.com/support/prepare-your-network-for...
Well no, not if you yourself are also using Cloudflare
cf.worker.upstream_zone ne "" and not cf.worker.upstream_zone in {"aimoda.workers.dev" "ai.moda"}
Link: https://developers.cloudflare.com/fundamentals/get-started/r...
cf-worker: example.com