Cloudflare Security Effectiveness Assessment — cyberbackgroundchecks.com

Scope: Single zone — cyberbackgroundchecks.com (zone ID 76bf9dce60dcc5e196d25190a4eb9952, Enterprise Website plan) Evidence window: Last 30 days (2026-06-25 → 2026-07-25)

1. Executive Summary

• Very high traffic under intense attack. The zone served 992.1M requests / 13.07 TB over 30 days, but only 17.9% cached — because 396.8M requests (40.0%) were served a 403. Notably, 25.7M requests were rate-limited (429) — the heaviest rate-limit enforcement in the estate — and 42.8M requests hit 404 (enumeration probing). (Confirmed)
• Traffic is heavily automated. Of ~962M scored requests, ~43% score as automated, ~40% likely-human, ~18% grey. Cloudflare flagged 93.1M requests as threats. US/Canada traffic is largely clean; foreign traffic (Netherlands, Italy, Vietnam, Brazil) runs at 95–99% threat rates. (Confirmed)
• Cloudflare's behavioral/volumetric defense here is the strongest in the estate. Custom rules generated 655.9M events (91.0M blocks), rate limiting fired 31.3M times across record/lookup endpoints, DDoS L7 mitigated 8.9M, and the managed-challenge layer issued 329.4M challenges at a ~96.6% abandonment rate (plus a legacy JS-challenge layer). (Confirmed)
• But the Managed WAF / OWASP ruleset is inactive. It generated only 170 events in 30 days — no signature-based defense (SQLi/XSS/RCE) and no WAF-layer telemetry, despite /email/, /phone/, /address/, and /detail/ lookup endpoints. (Confirmed)
• Rate limiting is genuinely broad here — the standout strength. It challenges the /removal (DSAR) flow and address/email/phone/person-record lookups, giving the zone a real second enforcement mechanism most properties lack. (Confirmed)
• Security-level challenging is off, and enforcement still concentrates in one dominant custom rule (~93% of blocks). (Confirmed / Likely)
• Perimeter hygiene is clean. DNS (36 records): production is proxied (AWS ELB); no origin IP, admin panel, or RFC1918 is exposed. (Confirmed)
• Overall risk: HIGH (lower boundary) — the most-attacked PII property in the estate, with excellent volumetric/behavioral controls but no active signature WAF and security level off. The strong rate limiting, DDoS L7, and bot challenges are why the risk is not worse. Executive score: 68/100.

2. Traffic Overview

30-day totals (Confirmed — httpRequests1dGroups)

Edge response codes (Confirmed): 200 490.5M (49.4%) · 403 396.8M (40.0%) · 404 42.8M (4.3%) · 429 25.7M (2.6%) · 301 22.2M · 400 6.69M · 499 4.39M · 302 1.38M · 304 1.37M · 500 218K. The 40.0% 403 rate plus 25.7M 429s is a large, multi-mechanism enforcement footprint; the 42.8M 404s indicate heavy probing of non-existent paths (enumeration).

Human vs Bot breakdown

Derived from the adaptive bot-score dataset — estimates with stated assumptions. Unusually, only ~121M (11%) of the adaptive total (≈1.08B) was unscored — because the low cache ratio means most requests reach the bot engine. Percentages are given as a share of scored traffic.

Verified good bots (Confirmed — verifiedBotCategory, ~72M total): AI Crawler 21.8M · Advertising & Marketing 16.9M · SEO 15.0M · Search Engine Crawler 12.1M · Security 1.54M · Page Preview 1.16M · other <1.2M each.

Assumptions: (1) botScore < 30 = automated per Cloudflare guidance; (2) unscored traffic excluded from ratios (cache-dominated); (3) verified good bots reported separately as they legitimately score low. Takeaway: automated traffic slightly exceeds likely-human in scored requests; the low unscored share means this property's bot picture is unusually well-observed.

3. Cloudflare Protection Effectiveness

Observed firewall events over 30 days. Rule thresholds/bodies were not readable (403); ratings rest on observed action volumes.

3.1 Events by source (Confirmed)

3.2 Events by action (Confirmed, all sources)

managed_challenge 329.4M · managed_challenge_bypassed 234.1M · block 91.0M · skip 26.3M · managed_challenge_non_interactive_solved 7.06M · managed_challenge_interactive_solved 4.04M · challenge (legacy JS) 2.11M · challenge_solved 1.36M · challenge_bypassed 777K · allow 21.3K.

3.3 Per-protection scorecard

Challenge math (Confirmed): 329.4M managed challenges issued, 11.10M solved → ~96.6% abandonment (plus 2.11M legacy JS challenges, 1.36M solved). A further 234.1M "bypassed" events are returning clients with valid clearance tokens (benign).

Managed WAF finding (Confirmed): the Cloudflare Managed Ruleset (v377) and OWASP Core Ruleset (v88) appear in the ruleset inventory but generated only 170 firewall events in 30 days. There is no active signature defense and no WAF-layer telemetry, despite /email/, /phone/, /address/, and /detail/ lookup endpoints that constitute an injection/exploit surface.

Rate-limiting finding — the standout strength (Confirmed): rate limiting fired 31.3M times, the heaviest and broadest in the estate. The dominant rule (8d6a9f57…, 23.8M) spreads across record/lookup paths; a second rule (a1de254d…, ~1.06M legacy challenge) protects the /removal DSAR flow; a third (60a553c3…) covers additional paths. Targeted paths include /removal, /address/<addr>, /email/<email>, and /phone/<number>.

Security-level finding (Likely): no securitylevel events were observed, indicating reputation-based challenging is not active. The exact setting value returned 403 (Unknown), but its behavioral signature is absent.

4. Attack Analysis

(All Confirmed from 30-day firewall events unless noted.)

Top attacking countries (block events): Netherlands 12.74M · Italy 8.02M · Vietnam 7.80M · Brazil 7.30M · France 5.26M · Germany 4.68M · Argentina 3.66M · Dominican Republic 2.85M · Pakistan 2.54M · South Africa 2.01M · Bangladesh 1.84M · Colombia 1.79M. (US/CA largely clean; NL and IT dominate the foreign block volume.)

Top attacking ASNs (operator names from public registries, not Cloudflare data — Likely): AS396982 Google Cloud 8.79M · AS45899 VNPT (Vietnam) 7.00M · AS14061 DigitalOcean 4.99M · AS63949 Akamai/Linode 4.50M · AS29066 Velia.net (Germany) 3.44M · AS64445 (hosting) 3.10M · AS34081 (Italy hosting) 1.81M · AS16509 Amazon AWS 1.66M · AS14593 SpaceX Starlink 1.57M · AS9009 M247 1.46M · AS212238 Datacamp/CDN77 1.21M. Overwhelmingly cloud/hosting-based scraping.

Top targeted paths (block events): / 7.11M · /removal 1.10M (DSAR flow) · /robots.txt 636K · /favicon.ico 437K · a long tail of /detail/<name>/pid<id> person-record pages (harry-j-devilbiss, tina-mcdonald, jacqueline-a-oshea, jeffrey-a-zoller, lorraine-salome, wade-t-smith, robin-r-huff, brooke-carpenter, …) · /people/<name>/<state>/<city> · /name. (One blocked path shows a malformed doubled-URL — a scraper bug — confirming automated origin.)

Top abusive IPs (block events): 92.204.248.55 (GoDaddy hosting) 3.33M · 2803:9810:c364:… (IPv6, Latin America) 679K · 63.32.23.121 (AWS Ireland) 544K · 38.159.36.19 519K · 152.167.217.211 508K · 52.215.186.214 (AWS) 377K · 54.194.183.189 (AWS) 336K · DigitalOcean fleet (159.223.225.123, 209.38.104.65) ~212–224K.

Top blocked user-agents (Confirmed): SirdataBot 9.35M (ad-tech crawler) · Chrome-111/Mac 8.01M · ias-ie/3.3 (Integral Ad Science) 3.36M (ad-verification crawler) · generic Chrome 124/120/110 ~3.2–3.3M each. (Ad-tech crawlers Sirdata + IAS ≈ 12.7M combined — see note.)

Most common WAF detections (Confirmed): with the managed WAF inactive, all blocks come from custom rules — one rule (13978d19…) accounts for 85.01M blocks (~93%); rule 7f38b35b… 465K; others minor. Rule names/expressions were not readable (403).

Most common rate-limit triggers (Confirmed): the /removal DSAR flow (legacy challenge, ~1.06M) plus record/lookup endpoints — /address/<addr>, /email/<email>, /phone/<number> — via managed challenge (the 23.8M-event rule spreads across many such paths).

Abuse-indicator summary

Two evidence limits: (1) Cloudflare edge data cannot confirm account-level/authenticated abuse — needs backend correlation. (2) With the managed WAF inactive, the zone has no telemetry on signature-based attacks — their absence here is a visibility gap, not proof they aren't occurring, and it matters given the lookup-endpoint surface.

Ad-tech blocking note (Likely, needs business confirmation): the largest blocked crawlers are commercial ad-tech (Sirdata 9.4M, Integral Ad Science 3.4M). Confirm with the ad/revenue team whether these should be allowed (partners) or kept blocked.

5. Protection Coverage

✓ Enabled / Confirmed active

• Enterprise plan; Universal TLS certificate (Google Trust Services active, valid to 2026-08-31)
• Apex, www, stage_eb proxied (origin is AWS ELB)
• Custom firewall ruleset — the primary engine (91.0M blocks + 329.4M challenges), actively tuned (v168)
• Rate limiting — the estate's strongest and broadest (v40): removal flow + address/email/phone/person-record lookups (31.3M events)
• DDoS L7 managed ruleset — active (8.9M mitigations)
• Bot Management — entitled and scoring live traffic; Managed Challenge (96.6% abandon) + legacy JS Challenge in use
• Cloudflare Managed Ruleset (v377), OWASP Core (v88), Exposed Credentials Check — present in inventory (but see gaps)
• URL Normalization; cache-settings and config-settings phases present; 98.9% encrypted
• Clean DNS — production proxied, no origin IP / admin panel / RFC1918 exposed

⚠ Missing / inactive protections

• Managed WAF / OWASP enforcement — present in inventory but generating only 170 events. No signature defense, no WAF telemetry.
• Security-level reputation challenge — no securitylevel events observed; appears essentially off.

⚠ Weak configuration

• Single-rule concentration — ~93% of blocks come from one custom rule; no signature backstop behind it.
• No signature-defense tier — all enforcement is behavioral/volumetric (rate limit, challenge, bot score, DDoS).

⚠ Unverifiable configuration (Unknown — 403)

• SSL/TLS mode, min-TLS version, HSTS, exact security-level value, Page Shield status, Bot Management action config. Verify with a settings-scoped token. Certificates are Universal-only (no Advanced certificate); the Let's Encrypt backup pack shows expired (2026-07-14) while the active Google cert is valid — worth tidying.

6. Operational Risk: HIGH (lower boundary)

Why HIGH:

1. No active signature WAF on a lookup-heavy PII surface. The Managed WAF/OWASP ruleset generated only 170 events, so injection/exploit attempts against /email/, /phone/, /address/, and /detail/ endpoints are neither blocked nor recorded. There is no signature-defense tier behind the custom rules. (Confirmed)
2. The most-attacked property in the estate — 40.0% of traffic 403'd, 25.7M rate-limited, 42.8M enumeration 404s — with enforcement concentrated in one dominant custom rule (~93% of blocks). (Confirmed)
3. Security level is off, removing a reputation-challenge layer. (Likely)

Why not CRITICAL (and why at the lower boundary of HIGH):

• The behavioral/volumetric defense is the strongest in the estate — the heaviest and broadest rate limiting (31.3M events across record/lookup paths), active DDoS L7 (8.9M), a 96.6% challenge-abandonment rate, and active Bot Management. These genuinely contain the scraping campaign. (Confirmed)
• The perimeter is clean — production is proxied, no origin IP / admin panel / RFC1918 exposed, so the edge cannot be trivially bypassed. (Confirmed)
• No edge evidence of successful mass exfiltration. (Confirmed)

7. Recommendations (evidence-prioritized)

Highest impact

1. Activate the managed WAF / OWASP ruleset — the one missing defense tier. Bring it into active execution (block high-confidence signatures; brief log-then-tune for the rest). This is the single change that most improves posture: it adds signature defense and telemetry for the /email/, /phone/, /address/, /detail/ surface and provides a backstop behind the dominant custom rule. Evidence: 170 managed events in 30 days. — Low–Medium effort
2. Reduce single-rule dependence. Spread the dominant block logic (currently ~93% of blocks in one rule) across layered rules, and lean on the managed WAF once active. Evidence: rule 13978d19… = 85M blocks. — Medium effort

Sustaining

1. Turn security level on to add a reputation-challenge layer ahead of the custom rules. Evidence: zero securitylevel events. — Low effort
2. Preserve the rate-limiting and DNS strengths. The broad rate-limiting coverage and clean, fully-proxied DNS are this zone's best controls — maintain them as the property evolves. — Low effort (governance)
3. Confirm the ad-tech bot policy (SirdataBot 9.4M, IAS 3.4M) with the revenue team. — Low effort

Verify (blocked by token scope this run)

1. Confirm SSL/TLS mode = Full (strict), min-TLS ≥ 1.2, HSTS enabled, and Page Shield status with a settings-scoped read token, and tidy the expired Let's Encrypt backup cert pack. — Low effort

None of these require new licensing — all sit within the existing Enterprise entitlement.

8. Executive Score: 68 / 100

Interpretation: Excellent behavioral defense, one missing tier. The estate's strongest rate limiting, DDoS mitigation, and bot challenges contain an intense scraping campaign on a clean perimeter — but there is no active signature WAF, and enforcement leans on a single custom rule.

Bottom line: cyberbackgroundchecks.com absorbs the estate's heaviest attack and defends against it with the estate's strongest behavioral controls — the broadest rate limiting, active DDoS L7, a 96.6% challenge-abandonment rate, and active Bot Management, all on a clean, fully-proxied perimeter. The one structural gap is the inactive managed WAF: there is no signature defense or attack telemetry for the /email/, /phone/, /address/, and /detail/ lookup surface, and enforcement leans on a single custom rule. Activating the managed WAF — within the current plan — is the single change that would give this otherwise strongly-defended property the layered defense its traffic profile demands.