{"id":15715606,"url":"https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB","last_synced_at":"2025-03-12T15:31:26.391Z","repository":{"id":263528881,"uuid":"842819187","full_name":"sefinek/Cloudflare-WAF-To-AbuseIPDB","owner":"sefinek","description":"A Node.js script that automates the reporting of incidents detected by Cloudflare WAF to AbuseIPDB ☁️🕵️","archived":false,"fork":false,"pushed_at":"2025-02-13T01:57:27.000Z","size":305,"stargazers_count":9,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-10T13:55:07.340Z","etag":null,"topics":["abuseipdb","abuseipdb-api","abuseipdb-reporting-tool","cloudflare","cloudflare-waf","cloudflare-waf-expression","cloudflare-waf-expressions","cloudflare-waf-rules","javascript","nodejs","nodejs-project","reporting","reporting-tool"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sefinek.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":"sefinek","ko_fi":"sefinek","buy_me_a_coffee":"sefinek","patreon":"sefinek","custom":["https://www.paypal.me/sefinek24"]}},"created_at":"2024-08-15T06:44:08.000Z","updated_at":"2025-03-07T03:46:13.000Z","dependencies_parsed_at":"2024-12-26T23:04:28.742Z","dependency_job_id":"54afbd99-0c80-4126-9e5a-87cff1c9b589","html_url":"https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB","commit_stats":null,"previous_names":["sefinek/cloudflare-waf-to-abuseipdb","sefinek24/node-cloudflare-waf-abuseipdb"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sefinek%2FCloudflare-WAF-To-AbuseIPDB","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sefinek%2FCloudflare-WAF-To-AbuseIPDB/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sefinek%2FCloudflare-WAF-To-AbuseIPDB/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sefinek%2FCloudflare-WAF-To-AbuseIPDB/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sefinek","download_url":"https://codeload.github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243242883,"owners_count":20259844,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["abuseipdb","abuseipdb-api","abuseipdb-reporting-tool","cloudflare","cloudflare-waf","cloudflare-waf-expression","cloudflare-waf-expressions","cloudflare-waf-rules","javascript","nodejs","nodejs-project","reporting","reporting-tool"],"created_at":"2024-10-03T21:42:08.842Z","updated_at":"2025-03-12T15:31:26.375Z","avatar_url":"https://github.com/sefinek.png","language":"JavaScript","funding_links":["https://github.com/sponsors/sefinek","https://ko-fi.com/sefinek","https://buymeacoffee.com/sefinek","https://patreon.com/sefinek","https://www.paypal.me/sefinek24"],"categories":[],"sub_categories":[],"readme":"# Cloudflare WAF to AbuseIPDB ☁️🕵️\nThis project offers an automated script that collects and reports IP addresses that have triggered Cloudflare firewall events.\nIn simple terms, it enables the reporting of incidents detected by Cloudflare WAF to the AbuseIPDB database.\n\nIf you're looking for **effective WAF Expressions**, you're in the right place! Check out [sefinek/Cloudflare-WAF-Expressions](https://github.com/sefinek/Cloudflare-WAF-Expressions).\nAlso, take a look at [sefinek/UFW-AbuseIPDB-Reporter](https://github.com/sefinek/UFW-AbuseIPDB-Reporter) for UFW.\n\n\u003e If you like this repository or find it useful, I would greatly appreciate it if you could give it a star ⭐. Thanks a lot!\n\n## 🛠️ Prerequisites\n- [Node.js + npm](https://nodejs.org)\n- [PM2](https://www.npmjs.com/package/pm2) (recommended)\n\n\n## 📃 Information\nIf you want to make changes to the script from this repository, please kindly [fork](https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB/fork) it first.\n\n\n## 🌌 Example Report\n```\nTriggered Cloudflare WAF (securitylevel) from T1.\nAction taken: MANAGED_CHALLENGE\nASN: 53667 (PONYNET)\nProtocol: HTTP/1.0 (method GET)\nEndpoint: /\nTimestamp: 2024-11-09T19:20:18Z\nRay ID: 8e0028cb79ab3a96\nRule ID: badscore\nUA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5042.0 Safari/537.36\n\nReport generated by Cloudflare-WAF-To-AbuseIPDB:\nhttps://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB\n```\n\n\u003cdiv align=\"center\"\u003e\n    My profile: https://www.abuseipdb.com/user/158699\n\u003c/div\u003e\n\n\n## 📥 Installation\n1. Clone the repository.\n   ```bash\n   git clone https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB.git\n   ```\n2. Install dependencies.\n   ```bash\n   npm install\n   ```\n3. Create a new configuration file.\n   ```bash\n   cp config.default.js config.js\n   ```\n4. Paste the tokens into the `config.js` file. Make sure that `NODE_ENV` is set to `production`.\n   ```bash\n   nano config.js\n   ```\n5. Run the script.\n   ```bash\n   node .\n   ```\n6. If you want to run the process 24/7, install the [PM2](https://www.npmjs.com/package/pm2) module.\n   ```bash\n   npm install pm2 -g\n   ```\n7. Modify the log paths in the `ecosystem.config.js` file to be correct and existing. You don't need to create `.log` files, just ensure the directory structure is accurate.\n8. Run the process continuously using `PM2` to ensure constant operation and automatic restart in case of a failure.\n   ```bash\n   pm2 start\n   ```\n9. Save a snapshot of the currently running `Node.js` processes.\n   ```bash\n   pm2 save\n   ```\n10. Add `PM2` to startup.\n   ```bash\n   pm2 startup\n   ```\n11. Execute the command generated by PM2, e.g.:\n   ```bash\n   sudo env PATH=$PATH:/usr/bin /usr/lib/node_modules/pm2/bin/pm2 startup systemd -u sefinek --hp /home/sefinek\n   ```\n12. That’s it! Monitor logs using the `pm2 logs` command.\n\n\n## 🔤 How to Get Tokens?\n### `CLOUDFLARE_ZONE_ID`\n![](images/brave_UY5737SsDdlS.png)\n\n### `CLOUDFLARE_API_KEY`\n1. Go to [dash.cloudflare.com/profile/api-tokens](https://dash.cloudflare.com/profile/api-tokens).\n2. Click the `Create Token` button.\n3. Select `Create Custom Token`.\n4. ![](images/brave_oWibgugvXlTH.png)\n\n### `ABUSEIPDB_API_KEY`\nVisit [www.abuseipdb.com/account/api](https://www.abuseipdb.com/account/api).\n\n\n## 😉 Issues and Pull requests\nIf you need help or have any questions, feel free to create a new [Issue](https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB/issues). If you'd like to contribute to the project, go ahead and open a [Pull request](https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB/pulls). Thank you!\n\n\n## 💕 Credits\nThis project is inspired by the [MHG-LAB/Cloudflare-WAF-to-AbuseIPDB](https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB) repository.\nI'm not particularly fond of Python and usually try to avoid using this programming language, which is why I decided to create this repository.\n\n\n## 📑 [MIT License](LICENSE)\nCopyright 2024-2025 © by [Sefinek](https://sefinek.net). All Rights Reserved.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsefinek%2FCloudflare-WAF-To-AbuseIPDB","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsefinek%2FCloudflare-WAF-To-AbuseIPDB","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsefinek%2FCloudflare-WAF-To-AbuseIPDB/lists"}