Entire IP range blocked by CDN (403) - not a self-triggered rate limit

[provitex-basaran]

Describe the bug

We are getting persistent 403 Forbidden responses from database.clamav.net
when running freshclam, even for small CDIFF patch downloads, and even
after the stated cool-down period expired.

We verified this is NOT a self-caused rate limit on a single host: we
tested from a completely separate server in our network (different public
IP, never made a freshclam/CVD request before) and it also received 403
immediately.

Affected IP-Block:
77.95.220.0/24

cf-ray IDs:
a16db52ffc101970-FRA
a16dc4068c0ee862-FRA
a16deb2f6bf9d3ac-FRA
a16deb2fac861e4d-FRA
a17613353b0cd247-FRA
a1763830ba1bc8d5-FRA
a1763830f869d389-FRA

How to reproduce the problem

Run freshclam from a host with the affected IP.

freshclam --version:
ClamAV 1.4.3/27813/Tue Nov 4 11:54:30 2025

freshclam.conf (relevant settings):
DatabaseMirror db.local.clamav.net
DatabaseMirror database.clamav.net
ScriptedUpdates yes
CompressLocalDatabase yes
Checks 24

[provitex-basaran]

Additional evidence: This block is not new. We found that another server
in our network (px-10007, same IP range 77.95.220.0/24) has been failing
with the identical 403 error since 2026-04-01 - three months before we
started investigating. Its freshclam service has been in "failed" state
ever since (systemd did not auto-restart it), so no further attempts were
logged after that date.

cf-ray from 2026-04-01 failure: 9e535dedff566955-FRA

[val-ms]

I will reach out to our cloudflare account admin for help.

[val-ms]

@provitex-basaran Our cloudflare account admin confirmed and fixed the issue. Please try again. You may need to delete the freshclam.dat file in any clamav database directories if it's been less than 24 hours since the last failed attempt.