Issues with Cloudflare "unusual traffic" detections / captchas

[chris4565]

Hey everyone, I hope this is the correct place to post this. Since a few weeks, I have a multitude of issues regarding Cloudflare / captchas. This issue came up pretty much out of nowhere. Basically, on several sites, I have to either check one of those boxes to confirm that I'm not a robot (because quote "unusual traffic from my network got detected") or I have to enter a captcha (both especially when using Chrome). A few more notes:

• Issue happens on both of my MacBook Pros.
• No common Chrome extensions on both machines.
• Restarting every router / repeater / access point in my house didn't help.
• Since it affects multiple devices and since I keep every device and every app / program up-to-date, I think malware cannot be the issue here.
• Can be triggered in 100% of the cases when I try to access "allestörungen.de" (German version of Downdetector) in Chrome in a private browsing window. Does not happen in Safari in a private browsing window.
• Can also be triggered in 100% of the cases when I try to access "amazon.com" in Chrome in a private browsing window.
• Both cases above also happen in non-private browsing in Chrome sometimes, but entering private browsing mode is a 100% reliable way to trigger it for me.
• Less issues in Safari but I, e.g., had to check one of those boxes when I accessed my PayPal account (was not necessary in the past).
• Also less issues with my iPhone but I installed Chrome just to test, visited "amazon.com" --> Immediately a captcha came up.

These problems really get annoying so any help from you guys is appreciated. Thanks a lot in advance!

EDIT: Tried the steps on a third MacBook Pro in my household. Could replicate the Amazon issue in 100% of the cases but the issue with "allestörungen.de" is non-existens there, the Cloudflare message does not come up there. It's really weird, I would just like to understand what's going on.

 

[FreakinEurekan]

Using a VPN?

 

[blotchy-veil]

If you get it less on Safari, it's probably because you have this setting enabled (it's on by default): https://www.macrumors.com/how-to/how-to-bypass-website-captchas-on-iphone-and-ipad/

Apple devices are all very similar, and depending on your network configuration (VPN/iCloud Private Relay/ISP using CGNAT), you might share an IP address with other users. Cloudflare is pretty annoying about forcing humans to prove they're not bots.

Do you get those warnings if you are on mobile hotspot? If all else fails, you can try calling your ISP to ask if something changed on their end.

 

[JonaM]

The reCaptcha will prompt in situations where it thinks you may not be human - this can be because it cannot detect your previous pattern of browsing to gain evidence that you've been browising 'normally'. This is why private browser mode can often trigger it as it's hiding previous cookies and browsing activity so it looks more like a brand new browser.
The next one can be the IP address you are connecting from - if you are using a VPN or have lots of devices coming from the same IP address it can conclude that IP address doesn't look like a single human at the end and ask you to verify.
From your description it sounds like you are triggering some via hiding browser behaviour and possibly some related to your IP address ( VPN or your internet Provider routing lots of traffic through the same IP address)

 

[chris4565]

Thanks guys for your answers!

Using a VPN?

Nope.

Apple devices are all very similar, and depending on your network configuration (VPN/iCloud Private Relay/ISP using CGNAT), you might share an IP address with other users. Cloudflare is pretty annoying about forcing humans to prove they're not bots.

Do you get those warnings if you are on mobile hotspot? If all else fails, you can try calling your ISP to ask if something changed on their end.

I neither use a VPN nor iCloud Private Relay. I tried these same tests at work today (completely different WiFi in another city) and I had the EXACT same issues with the 2 sites mentioned in my original post. Also: I asked 2 of my colleagues to check these sites with the exact same steps that lead to the issues in my case. They tried with their respective WiFi networks at home and they both had the exact same issues as me. So maybe these 2 sites are overly sensitive. Still weird that the third MacBook that I used for testing in my home network only exhibits issues with ONE of the 2 sites mentioned above. I guess I'll stop worrying too much and just accept it 😅

The next one can be the IP address you are connecting from - if you are using a VPN or have lots of devices coming from the same IP address it can conclude that IP address doesn't look like a single human at the end and ask you to verify.
From your description it sounds like you are triggering some via hiding browser behaviour and possibly some related to your IP address ( VPN or your internet Provider routing lots of traffic through the same IP address)

I don't use a VPN. There are several devices connected to my home WiFi (phones, tablets, notebooks, smart lights, etc.) but I wouldn't say it's "too much".

 

[blotchy-veil]

So maybe these 2 sites are overly sensitive. Still weird that the third MacBook that I used for testing in my home network only exhibits issues with ONE of the 2 sites mentioned above. I guess I'll stop worrying too much and just accept it 😅

Welcome to the modern web! (/s) I use several sites that force reCAPTCHA/hCaptcha/Cloudflare until you're logged in, including on the first attempt to log in. I genuinely think they're configured to serve those challenges to everyone with no actual bot detection. Apple devices are harder to fingerprint, too, since there's only a few models that sell in large quantities, so they tend to get more challenges.

 

[dmccloud]

Cloudflare doesn't always play well with browser updates, and since each site can be using a different version of Cloudflare's services on the backend, you could have issues accessing one site while another site is working perfectly fine. Just a couple of months ago, Cloudflare's services on one of the sites I frequent broke and were blocking most incoming traffic. The issue eventually got fixed, but it took almost two weeks for the website team to address the problem.