METRICKEEPER
Get Early Access //
← Back to Archive
// Guides2026-07-295 min read

How to Find the Top IPs Hitting Your Cloudflare Site

Something is hammering your site. Maybe it’s a scraper, a credential-stuffing bot, or a misconfigured client. Your first question is: who?

Here’s how to get the answer from Cloudflare, in the dashboard and through the API.

Option 1: The dashboard

Go to Security → Events (called Security Analytics on some plans) for the zone. The top-N panels show the most frequent:

  • Source IPs
  • ASNs and countries
  • Paths and user agents
  • Rules and actions

Click an IP to filter the whole view to that address. This is the fastest way to answer “who is it and what are they doing?”

The catch: Security Events only go back 24 hours on Free and Pro, 3 days on Business, and 30 days on Enterprise. Details in Cloudflare Security Events retention.

Option 2: The GraphQL API

For scripts, reports, or anything you want to keep, query firewallEventsAdaptiveGroups and sort by count:

query ($zoneTag: string, $start: Time, $end: Time) {
  viewer {
    zones(filter: { zoneTag: $zoneTag }) {
      firewallEventsAdaptiveGroups(
        limit: 25
        filter: { datetime_geq: $start, datetime_lt: $end }
        orderBy: [count_DESC]
      ) {
        count
        dimensions {
          clientIP
          clientCountryName
          action
        }
      }
    }
  }
}

Variables, for the last 24 hours:

{
  "zoneTag": "your-zone-id",
  "start": "2026-07-28T00:00:00Z",
  "end": "2026-07-29T00:00:00Z"
}

Because the query groups by clientIP and action, an IP that was challenged some of the time and blocked the rest of the time appears as two rows. Remove action to get one total per IP.

Useful variations

  • Only blocked traffic: add action: "block" to the filter.
  • One path under attack: add clientRequestPath: "/login" to the filter.
  • By network, not IP: group by clientAsn instead of clientIP. Rotating botnets often share an ASN even when every IP is different.

What about all traffic, not just security events?

Security Events only include requests that a security feature acted on or logged. For a top-IPs list across all traffic, look at the httpRequestsAdaptiveGroups dataset. Which dimensions are available depends on your plan; check availableFields in the settings node.

The real question: “Has this IP been here before?”

Finding today’s top IP is easy. The harder and more useful question is whether it’s new:

  • Did the same IP or ASN probe you last month?
  • Is this a slow campaign that stays under the radar each day?
  • Did it show up right before an incident?

With a 24-hour window, you can’t answer any of those. You need yesterday’s top-IP list, and last week’s, and last month’s, saved before they expire. That’s the core idea behind tracking suspicious IP patterns over 90 days.

Save the query above to storage every few hours, or schedule it in a Worker.

Keep every day’s top IPs

MetricKeeper connects with a read-only token and archives your Cloudflare security analytics on a schedule, so “has this IP been here before?” has an answer.

Get Early Access →

Sources