Website is getting fraudulent traffic

[Deleted member 731332]

The issue with this is that it doesn't work through iframe embeds:

View attachment 419588

It actually makes every embed not work. We could not include the embeds as part of the WAF, but then people could still send fake traffic through these embeds.

Can you use embed, object, or video elements instead of iframe?

 

[DoodStream76]

Can you use embed, object, or video elements instead of iframe?

Not sure. Here's an example of our embed code:

<iframe src="https://savefiles.com/e/1738768927081e866d5d35710152c" width="800" height="600" allowfullscreen allowtransparency allow="autoplay" scrolling="no" frameborder="0"></iframe>

Our ad networks are still saying we have bots, which sucks because I'm trying to find the best way to detect this fraud and block it

 

[Deleted member 731332]

Not sure. Here's an example of our embed code:

<iframe src="https://savefiles.com/e/1738768927081e866d5d35710152c" width="800" height="600" allowfullscreen allowtransparency allow="autoplay" scrolling="no" frameborder="0"></iframe>

Our ad networks are still saying we have bots, which sucks because I'm trying to find the best way to detect this fraud and block it

Try to find another way to display the video that is more secure and won’t interfere with your web application firewall. That would be my first move.

 

[DoodStream76]

Try to find another way to display the video that is more secure and won’t interfere with your web application firewall. That would be my first move.

Well every other large file host such as Streamtape, uses iFrame. So if they can get away with detecting and blocking fraud, so should I

 

[Deleted member 731332]

Well every other large file host such as Streamtape, uses iFrame. So if they can get away with detecting and blocking fraud, so should I

Is the issue that your page is being loaded on other websites in iframes?

Have you tried using the X-FRAME-OPTIONS header tag, specifically with DENY, and SAME origin?

Do you have a content security policy header?

 

[DoodStream76]

Have you tried using the X-FRAME-OPTIONS header tag, specifically with DENY, and SAME origin?

This x-frame-options I’ve heard about. Was very complicated and I didn’t want to mess anything up. I might have to look into this more

 

[DoodStream76]

the issue that your page is being loaded on other websites in iframes

Yes our website provides embed iFrame code, which is loaded on other websites

 

[Deleted member 731332]

You could try Claude ai or chat gpt to help you with deploying the headers. I used to use Claude exclusively for coding, web servers, web dev etc but chat gpt 4o with websearch has stepped it up significantly.

Today I just deployed another bare metal LEMP stack for staging websites on my LAN with dedicated IPs for websites and SSL. ChatGPT only made one mistake, as compared to a year ago when it couldn’t do it at all.

I recommend having a staging site to make changes on and test to ensure there’s no issues before pushing to the production website.

 

[BlackHatAds]

Okay, I'm manually going through my Cloudflare and I'm searching top IP's.

I found this one: 45.128.78.194

When I go to RapidSeedbox website, they sell rotating residential proxies, which is obviously people sending fake traffic to my website.

Correct?

Now, there is a different ip 104.28.214.161:

It has "Hosting" as TRUE. Does this mean it is a bad ip too, and I should block it?

Try going to WAF => Create rule => Password leaked => Block. See if it works.

I was once attacked by a proxy. You can't block by IP since it changes constantly. WAF has many blocking options; you should take advantage of them.

 

[DoodStream76]

Try going to WAF => Create rule => leaked password => Block. See if it works.

What will “leaked passwords” do? Am I worried about passwords?

 

[BlackHatAds]

What will “leaked passwords” do? Am I worried about passwords?

Just try; most proxies are related to password leaks.

 

[DoodStream76]

Just try; most proxies are related to password leaks.

Okay, I’ll take your word for it. Thank you

 

[BlackHatAds]

Okay, I’ll take your word for it. Thank you

Just try and trust no one.
I don't even trust myself!

 

[Deleted member 731332]

What will “leaked passwords” do? Am I worried about passwords?

any thoughts on this firewall rule as of yet?

 

[DoodStream76]

any thoughts on this firewall rule as of yet?

0 Traffic for that so far. But the Managed Challenge for everyone with a threat score above 1 is good. I'm not sure if this will correlate to better cpms with our ad networks (meaning the fake traffic is blocked)

 

[Deleted member 731332]

View attachment 419955
0 Traffic for that so far. But the Managed Challenge for everyone with a threat score above 1 is good. I'm not sure if this will correlate to better cpms with our ad networks (meaning the fake traffic is blocked)

I use public and private proxies quite a bit. Since 2013. I was scratching my head at the statement that proxies are related to data leaks. CF uses their own list of leaked passwords and a third party list of leaked passwords which is the data that is used in relation to the leaked passwords WAF rule. It only contains leaked passwords.

 

[proxygo]

block traffic from specific countries that you identify as fraudulent

not all traffic from all countries is fraudulent