My discourse forum gets this like crazy scanners: a bot walks a wordlist against /u/<name>.json, collects the 404s, and learns which usernames exist. Each probe costs a Unicorn worker and hands the scanner a free answer.
put together a small Cloudflare Snippet that answers those probes at the edge with a believable but fake profile — 200, a stable id derived from the username, join date, trust level, post count, even a fake email address carrying a canary string. Real visitors pass straight through untouched: a session cookie, a same-site referer, Accept: text/html or an API key all mean “leave this alone”. The origin never sees a probe, so the change is less load, not more.
Hits are logged to New Relic with IP, ASN and network name, country, city, edge colo, HTTP/TLS version, user agent and the username that was probed. There’s an eleven-widget dashboard you can import, and NRQL for “who keeps coming back”.
One snippet slot. No KV, no Worker, no origin changes, no blocking.
still you have 4 left and can utilized with other sites in your account.
The docs cover the Cloudflare rule (note: the matches operator needs Business — use wildcard), the New Relic import (two placeholders must be replaced or it fails), and the Discourse caveats — including the case where the built-in hide user profiles from public setting is simply the better answer. but for me this was not possible.
i hope this helps someone. our server load has decreased within an hour of deployment.
