173.245.58.0 is owned by cloudflare (https://www.cloudflare.com/ips/). You're probably tracking the IP address of cloudflare's reverse proxy that hits your application instead of true source IP (which cloudflare will copy into X-Forwarded-For header).

Likely you pulled this IP from your application's logs? If you're trying to track bot traffic, use Cloudflare's built-in analytics tool.

Also a single source IP can be hosted in geographically distinct locations - that's called anycasting, which cloudflare does use, however I don't think that's the issue here.

Since it hasn't been mentioned, my first thought is valid users browsing on iOS with iCloud Private Relay enabled.

https://support.apple.com/en-us/102602

I have this enabled on my iPhone and websites that report my IP show the block is owned by Cloudflare or Akamai.

That's a Cloudflare IP — 173.245.x.x is their range. You're seeing Cloudflare's edge servers, not actual visitor IPs.

The multiple locations are just showing which Cloudflare POP handled each request (ORD, SJC, LAX = their data centers). That's expected behavior when you're proxied through CF.

Check the CF-Connecting-IP header to get the real visitor IP. What you're logging right now is basically "which Cloudflare server talked to your origin," not "where the bot actually is."

Are you using Cloudflare in front of your site? If so, the IP you’re seeing is Cloudflare’s and not the bot’s IP. You’d need to log and check the headers that Cloudflare sends you, i.e. x-forwarded-for and cf-connecting-ip.

As to how one IP can originating from multiple locations: anycast.

That IP address you shared is a CloudFlare IP address: https://bgp.tools/prefix/173.245.58.0/24#asinfo

I would have said that perhaps you are getting requests from people using their WARP proxy product - which isn't that wild. The reverse DNS on that page though suggests that the range is mainly full of name-servers, which would be strange to get requests from but I have no idea what cloudflare does on its network.

As for the multiple datacentre thing - one IP address can be Anycast-ed to multiple actual hosts in different physical locations.

For example, if I ping 173.245.58.0, I get a response in 11ms from my location here in Helsinki. At the speed of light this means travelling 3,300KM (0.011s * 3x10^8m/s) which doesn't get me anywhere near the States. So again, nothing exciting about 1 IP address coming from different locations. If you look at your raw logs - you might see some headers from cloudflare with more clues.

It's interesting, but as others have mentioned, not worth worrying about.

That specific IP is detected as anycast by bgp[dot]tools , which is likely as it is announced from AS13335, so backbone routers will choose the best route back to the multiple places it is announced from. If you traceroute such an IP from multiple geographic locations, you'll probably notice that the RTT is implausibly low from all locations (assuming a unicast announcement) - which is the benefit to anycast.

# AS13335 Cloudflare, Inc.:US San Francisco, California https://www.abuseipdb.com/check/

block from any to 173.245.58.0/24

# US https://www.abuseipdb.com/check/173.245.58.143

block from any to 173.245.58.140

# US https://www.abuseipdb.com/check/173.245.58.143

block from any to 173.245.58.143

# US https://www.abuseipdb.com/check/173.245.58.151

block from any to 173.245.58.151

# US https://www.abuseipdb.com/check/173.245.58.165

block from any to 173.245.58.165

In my use case, woocommerce in WP, I have WordFence security plugin, and it has a selection to choose which header to pull ip address from. Since I used cloudflare, I selected the appropriate checkbox, and the IPs were properly posting.

So, hopefully you are able to check on which header your requests are being hit with.

Other comments already mentioned it, but that’s to figure out with your anti-ddos/reverse proxy headers setup

As others mentioned, look at observability logs in your CloudFlare, check user agent, x-forward-address and asn.

Then block the ip/asn/service that’s causing the bot traffic if you deem useless.

Some bots can be related to SEO tools, these will have Search Engine Optimization category in CloudFlare

We’ve been experiencing the same thing. On further inspection, we discovered that the owner of the data centers was Tencent. So we blocked them at the ASN level across countries.

This was after web had to geo block China & Singapore some weeks earlier.

These AI scraping guys are destroying the web for normal folks in these countries where they run data scrapers.

Set up fail2ban and just forget about it. Or do like me and watch the bans roll by in the log file while having your morning coffee.

tirreno (1) guy here.

What you're seeing is normal bot behaviour, they constantly scan every website for different purposes. 100–500 requests per IP is nothing you should worry about or take any action against.

tirreno works on the backend, so sometimes we use it to analyze bot behaviour when they start doing something really suspicious, like massive requests (hundreds of thousands a day) or scanning all possible files/folder structures, which could easily result in half a million requests in short period of time.

1. https://github.com/tirrenotechnologies/tirreno

That is a Cloudflare IP address.

Have a look at the request HTTP headers and see what they say.

undefined

VPNs, proxies/relays, crawlers, etc

> hundreds of requests per day

Does this matter? I can handle hundreds of requests per day with no issue on a home cable modem connection and my desktop pc running nginx. In fact I do and have since the 56k days. With an actual server or VPS with a big pipe in a datacenter this should literally be below noticing in terms of cost.

I would characterize this response to normal public website traffic as more harmful than the "problem". There's no need to be upset that web spiders are visiting your public website. That is what public websites are for.

Anyway, if you really do want to persue this silly thing start by looking up the ASN the IP is in and go from there. Don't rely on cloudflare to interpret the internet for you. I wrote an offline geo-ip and whois db dump world map visualizer in 2025 and these are the resources I use:

## RIR whois/peering db # RIPE NCC https://ftp.ripe.net/ripe/dbase/split/ripe.db.aut-num.gz # ARIN https://ftp.arin.net/pub/rr/arin.db.gz # APNIC https://ftp.apnic.net/apnic/whois/apnic.db.aut-num.gz # LACNIC https://ftp.lacnic.net/lacnic/dbase/lacnic.db.gz # AFRINIC https://ftp.afrinic.net/dbase/afrinic.db.gz ## RIR Delegation files # https://www-public.telecom-sudparis.eu/~maigron/rir-stats/ # https://ftp.afrinic.net/pub/stats/afrinic/delegated-afrinic-... # https://ftp.apnic.net/stats/apnic/delegated-apnic-extended-l... # https://ftp.arin.net/pub/stats/arin/delegated-arin-extended-... # https://ftp.lacnic.net/pub/stats/lacnic/delegated-lacnic-ext... # https://ftp.ripe.net/pub/stats/ripencc/delegated-ripencc-ext...