Cloudflare Security Effectiveness Assessment — advancedbackgroundchecks.com

Scope: Single zone — advancedbackgroundchecks.com (zone ID 73ae3164ad1f307e11ae345062efd273, Enterprise Website plan) Evidence window: Last 30 days (2026-06-25 → 2026-07-25)

1. Executive Summary

• Moderate traffic and the lowest attack pressure in the estate. The zone served 299.7M requests / 1.92 TB over 30 days, with 34.95M requests (11.7%) served a 403 and only 5.7% of traffic flagged as threats — the lowest threat proportion reviewed. Traffic is ~93% US and the US traffic is exceptionally clean (8,782 threats out of 278M). (Confirmed)
• This is the most human-leaning property reviewed. Of ~297M scored requests, ~59% score as likely-human, ~27% automated, ~14% grey. Foreign scraping exists (Brazil, Netherlands, Vietnam) but at low volume. (Confirmed)
• Cloudflare enforcement is effective and — uniquely — includes an active reputation layer. Custom rules generated 99.4M events (17.1M blocks + 17.9M challenges) at a ~95.5% challenge-abandonment rate, and security level is actively firing (1.18M reputation challenges) — the only zone in the estate where it is. (Confirmed)
• The Managed WAF / OWASP ruleset is inactive. It generated only 180 events in 30 days — no signature-based defense and no WAF-layer telemetry, despite observed exploit-recon (e.g., /views/.env secrets probing) and a dynamic /search/results.aspx endpoint. (Confirmed)
• Rate limiting is configured but negligible. It fired only 42,250 times (targeting /names/, /emails/, /opt-out) — well-aimed but not materially triggering. (Confirmed)
• An origin-bypass record is published. fastly-origin.advancedbackgroundchecks.com is unproxied and points directly to the production origin hostname (abc-production…elasticbeanstalk.com), providing a route around the Cloudflare edge. (Confirmed)
• Enforcement still concentrates in one dominant custom rule (~99.9% of blocks). (Confirmed)
• Overall risk: MEDIUM — a low-attack, human-dominated PII property with active behavioral controls (custom rules + security level + bot challenge), but no active signature WAF, negligible rate limiting, and a published origin-bypass path. Executive score: 63/100.

2. Traffic Overview

30-day totals (Confirmed — httpRequests1dGroups)

Edge response codes (Confirmed): 200 248.8M (83.0%) · 403 34.95M (11.7%) · 404 8.74M (2.9%) · 308 2.14M · 301 1.94M · 499 1.40M · 307 885K · 500 600K · 302 54.6K · 502 45.6K. The 11.7% 403 rate is the estate's lowest, reflecting genuinely lower attack pressure on this property.

Human vs Bot breakdown

Derived from the adaptive bot-score dataset — estimates with stated assumptions. Only ~15.5M (5%) of the adaptive total (≈313M) was unscored — the low cache ratio means nearly all requests reach the bot engine. Percentages are given as a share of scored traffic.

Verified good bots (Confirmed — verifiedBotCategory, ~54M total): AI Crawler 40.6M · Search Engine Crawler 8.58M · Advertising & Marketing 2.34M · Security 0.82M · other <0.6M each. (AI-crawler traffic is overwhelmingly the largest verified-bot category — a heavy AI-training/crawl load on this property.)

Assumptions: (1) botScore < 30 = automated per Cloudflare guidance; (2) unscored traffic excluded from ratios (cache-dominated); (3) verified good bots reported separately as they legitimately score low. Takeaway: this is the most human-dominated property reviewed — nearly 60% of scored traffic is likely-human, consistent with the low 5.7% threat rate and clean US-centric traffic.

3. Cloudflare Protection Effectiveness

Observed firewall events over 30 days. Rule thresholds/bodies were not readable (403); ratings rest on observed action volumes.

3.1 Events by source (Confirmed)

3.2 Events by action (Confirmed, all sources)

managed_challenge_bypassed 58.8M · managed_challenge 17.9M · block 17.1M · skip 5.95M · allow 843K · managed_challenge_non_interactive_solved 667K · managed_challenge_interactive_solved 149K.

3.3 Per-protection scorecard

Challenge math (Confirmed): 17.9M challenges issued, 816K solved → ~95.5% abandonment. A further 58.8M "bypassed" events are returning clients with valid clearance tokens — a high ratio consistent with a human-heavy, repeat-visitor US audience.

Managed WAF finding (Confirmed): the Cloudflare Managed Ruleset (v377) and OWASP Core Ruleset (v88) appear in the ruleset inventory but generated only 180 events in 30 days. There is no active signature defense and no WAF-layer telemetry — notable because exploit-recon is observably occurring (e.g., /views/.env probes, see §4) and there is a dynamic /search/results.aspx endpoint.

Security-level finding — a distinguishing positive (Confirmed): unlike other properties in the estate, this zone's security-level reputation challenging is active (1.18M events), adding a layer that challenges low-reputation clients ahead of the custom rules.

Rate-limiting finding (Confirmed): correctly aimed at /names/, /emails/<b64>, and /opt-out, but fired only 42,250 times — negligible relative to the traffic; not materially contributing.

4. Attack Analysis

(All Confirmed from 30-day firewall events unless noted.)

Top attacking countries (block events): Brazil 1.97M · Netherlands 1.46M · France 889K · Vietnam 836K · Singapore 756K · Bangladesh 736K · Argentina 676K · Pakistan 556K · Iraq 496K · India 472K · Germany 418K · Colombia 363K. (All foreign and low-volume; US does not appear — US traffic is clean.)

Top attacking ASNs (operator names from public registries, not Cloudflare data — Likely): AS396982 Google Cloud 1.54M · AS45899 VNPT (Vietnam) 692K · AS29066 Velia.net (Germany) 432K · AS63949 Akamai/Linode 410K · AS14061 DigitalOcean 386K · AS45102 Alibaba Cloud 254K · AS16509 Amazon AWS 228K · AS263812/AS262287 (Brazil hosting) · AS17639 Converge ICT (Philippines) 146K · AS28573 Claro (Brazil) 131K. Cloud/hosting-based scraping, but at modest volume.

Top targeted paths (block events): / 51.4K · /robots.txt 40.4K · /favicon.ico 36.3K · /search/results.aspx 35.1K (dynamic search endpoint) · /names/<name> and /firstnames / /lastnames (name enumeration) · /people, /directory, /blog · /views/.env 2.2K (secrets-file probe — exploit recon) · /opt-out · /<name>_id_G<id> and /address/<addr> record pages.

Top abusive IPs (block events): 92.204.248.55 (GoDaddy hosting) 416K · 143.44.165.49 (50.8K) and 143.44.165.231 (39.6K) · 63.32.23.121 (AWS Ireland) 30.3K · a Google Cloud cluster (35.240.199.82, 35.240.238.234, 35.197.137.124, 35.247.152.15) ~19–22K each · AWS (54.194.183.189, 52.215.186.214) ~21K.

Top blocked user-agents (Confirmed): a near-uniform set of generic spoofed browser UAs — Chrome 145/144/142 and Edge variants on Windows/Mac — each blocked ~880–950K times. (The uniform distribution across near-identical modern-browser UAs is a user-agent-rotation scraping signature; no named crawler dominates.)

Most common "WAF" detections (Confirmed): with the managed WAF inactive, all blocks come from custom rules — one rule (8b6ca3f1…) accounts for 17.05M blocks (~99.9%); other rules are trivial. The /views/.env exploit-recon was caught by custom rules, not the (inactive) WAF. Rule names/expressions were not readable (403).

Most common rate-limit triggers (Confirmed): /names/ (managed challenge), /opt-out (block), and /emails/<b64> / individual /names/<name> pages — well-targeted at record/lookup enumeration but very low volume.

Abuse-indicator summary

Two evidence limits: (1) Cloudflare edge data cannot confirm account-level/authenticated abuse — needs backend correlation. (2) With the managed WAF inactive, the zone has no telemetry on signature-based attacks — the observed /views/.env probe is a reminder that exploit-recon is occurring and is currently caught (if at all) only by custom rules.

5. Protection Coverage

✓ Enabled / Confirmed active

• Enterprise plan; Universal TLS certificate (Google Trust Services active, valid to 2026-09-30; Let's Encrypt backup)
• Apex, www, www2, pro, dev, qa, stage, etc. proxied (origin is AWS Elastic Beanstalk)
• Custom firewall ruleset — the primary engine (17.05M blocks + 17.9M challenges), v136
• Security-level reputation challenge — active (1.18M events) — the only zone in the estate with this layer
• Bot Management — entitled and scoring live traffic; Managed Challenge in use (95.5% abandon)
• Cloudflare Managed Ruleset (v377), OWASP Core (v88), Exposed Credentials Check, DDoS L7 — present in inventory (but see gaps)
• URL Normalization; log-custom-fields phase present; 99.4% encrypted

⚠ Missing / inactive protections

• Managed WAF / OWASP enforcement — present in inventory but generating only 180 events. No signature defense, no WAF telemetry.
• Effective rate limiting — configured and correctly targeted but firing only 42,250 times; not materially contributing.

⚠ Inconsistent / weak configuration

• fastly-origin.advancedbackgroundchecks.com is unproxied, pointing directly to the production origin hostname (abc-production…elasticbeanstalk.com) — a published origin-bypass path around the Cloudflare edge.
• Single-rule concentration — ~99.9% of blocks come from one custom rule; no signature backstop.
• AWS Elastic Beanstalk default hostnames are publicly resolvable — the proxied origin should be access-restricted to Cloudflare so the edge can't be bypassed by hostname.

⚠ Unverifiable configuration (Unknown — 403)

• SSL/TLS mode, min-TLS version, HSTS, exact security-level value, Page Shield status, Bot Management action config. Verify with a settings-scoped token. Certificates are Universal-only (no Advanced certificate).

6. Operational Risk: MEDIUM

Why MEDIUM (not HIGH):

• Lowest attack pressure in the estate — 5.7% threats, 11.7% 403, and exceptionally clean US-dominated (93%) traffic. (Confirmed)
• Multi-layer behavioral defense is active — custom rules + an active security-level reputation layer (unique to this zone) + bot challenge (95.5% abandonment) + Bot Management. (Confirmed)
• Most traffic is genuinely human (~59% of scored), and there is no edge evidence of successful mass exfiltration. (Confirmed)

Why not LOW:

• The managed WAF is inactive (180 events) — no signature defense or telemetry, and exploit-recon (/views/.env) is observably occurring against a property with a dynamic /search/results.aspx endpoint. (Confirmed)
• A published origin-bypass path exists — fastly-origin is unproxied to the production origin hostname. (Confirmed)
• Rate limiting is negligible and enforcement leans on a single custom rule (~99.9% of blocks). (Confirmed)

7. Recommendations (evidence-prioritized)

Highest impact

1. Activate the managed WAF / OWASP ruleset. Bring it into active execution (block high-confidence signatures; brief log-then-tune for the rest). This adds signature defense and telemetry — directly relevant given the observed /views/.env exploit-recon and the dynamic /search/results.aspx endpoint. Evidence: 180 managed events in 30 days. — Low–Medium effort
2. Close the origin-bypass path. Re-proxy or remove fastly-origin, and restrict the AWS Elastic Beanstalk origin to accept traffic only from Cloudflare so the edge cannot be bypassed via the origin hostname. Evidence: fastly-origin unproxied to abc-production…elasticbeanstalk.com. — Medium effort

Sustaining

1. Make rate limiting effective. The targeting (/names/, /emails/, /opt-out) is right; raise sensitivity so it actually triggers under scraping load. Evidence: 42,250 rate-limit events. — Low effort
2. Reduce single-rule dependence. Spread the dominant block logic across layered rules (and rely on the managed WAF once active). Evidence: 99.9% of blocks from one rule. — Medium effort
3. Preserve the active security-level layer — it is a genuine strength unique to this zone; keep it enabled. — Low effort (governance)

Verify (blocked by token scope this run)

1. Confirm SSL/TLS mode = Full (strict), min-TLS ≥ 1.2, HSTS enabled, and Page Shield status with a settings-scoped read token. — Low effort

None of these require new licensing — all sit within the existing Enterprise entitlement.

8. Executive Score: 63 / 100

Interpretation: A low-attack, human-dominated property with genuinely layered behavioral controls (including a unique active reputation layer), held back by an inactive signature WAF, negligible rate limiting, and a published origin-bypass path.

Bottom line: advancedbackgroundchecks.com carries the estate's lowest attack pressure and most human-dominated traffic, and defends it with genuinely layered behavioral controls — custom rules, an active security-level reputation challenge (unique to this zone), bot challenges (95.5% abandonment), and Bot Management. The gaps are the same structural ones seen elsewhere plus one exposure: the managed WAF is inactive (no signature defense, and exploit-recon like /views/.env is occurring), rate limiting is negligible, and a fastly-origin record publishes an origin-bypass path. Activating the managed WAF and closing the origin-bypass — both within the current plan — would give this low-risk property a properly layered, resilient posture.