You can also use this online tool to check servers when reviewing the logs in cloudflare, this is an example of one of those serves that showed up, the radar tracks it as 86.8% bot

https://radar.cloudflare.com/bots/as132203

Here can be seen the 6th of September surge on on the graph and it coincides with the server traffic

A lot of these bots are hammering wordpress exploits with targets such as /wp-content/index.php and so on, it might not be a bad idea to block by default if you have server load issues.

yasas Yep seen the same last week, not nodeBB install, but the server behind cloudflare showed a huge uptick, not served by cache either. SO I am guessing scanning the whole site or large parts.

IIRC the traffic was coming manly from swiss-german based servers but did not have the time to dig in. This is even with Block AI cralwers turned on.

In the recent past it’s been Asia, like mostly Singapore.

The only way to handle this in Cloudflare is to watch and then put in place with geo-based challenge security rules in place afaict