Cloudflare Security Effectiveness Assessment — fastbackgroundcheck.com

Scope: Single zone — fastbackgroundcheck.com (zone ID 70b0cbf54c023af61b213b6afabb0b8c, Enterprise Website plan) Evidence window: Last 30 days (2026-06-25 → 2026-07-25)

1. Executive Summary

• High traffic, very aggressively filtered. The zone served 390.9M requests / 3.81 TB over 30 days, but only 8.8% cached — because 211.1M requests (54.0%) were served a 403, the largest enforcement proportion of the properties reviewed. Threats were 15.6% of traffic. (Confirmed)
• Traffic is heavily automated. Of ~371M scored requests, ~64% score as automated, ~30% likely-human, ~6% grey. US/Canada/Mexico traffic is largely clean, though the US did contribute ~5.25M threats (some domestic scraping); foreign traffic (Netherlands, France, Vietnam, Germany, Ireland) runs at 99%+ threat rates. (Confirmed)
• This zone has genuine layered defense — the strongest posture reviewed. Unlike a single-tier configuration, it runs an actively-enforcing managed WAF (4.85M blocks) alongside custom rules (329.8M events, ~56M blocks), a managed-challenge layer (146.1M issued, 92.8% abandonment), functional rate limiting, DDoS L7, and Bot Management. (Confirmed)
• The managed WAF is actually executing here. firewallManaged produced 4.85M block events — real signature-based enforcement that provides a backstop behind the custom rules. (Confirmed)
• Rate limiting is functional but narrow. It fired ~887K times, but exclusively on the /optout (DSAR/removal) flow — person-record scraping is handled by custom rules/challenge rather than rate limits. (Confirmed)
• Security-level challenging is off, and enforcement still leans on a dominant custom rule (~91% of custom blocks) — though, unlike other properties, it is now backed by the active managed WAF. (Confirmed / Likely)
• Perimeter hygiene is clean. DNS (38 records): production is proxied (AWS Elastic Beanstalk); no real origin IP, admin panel, or RFC1918 is exposed (the bb → 1.1.1.1 record is a harmless placeholder). (Confirmed)
• Overall risk: MEDIUM — a heavily-attacked PII property, but the best-defended in the estate: active signature WAF + custom rules + challenge + rate limiting on a clean perimeter. Residual risk comes from security level being off, narrow rate-limiting coverage, and heavy reliance on one custom rule. Executive score: 75/100.

2. Traffic Overview

30-day totals (Confirmed — httpRequests1dGroups)

Edge response codes (Confirmed): 403 211.1M (54.0%) · 200 143.8M (36.8%) · 301 29.7M (7.6%) · 302 2.87M · 429 1.15M · 499 773K · 404 758K · 304 287K · 204 268K · 410 114K. The 54.0% 403 rate explains the very low cache ratio — most traffic is blocked or challenged rather than served from cache.

Human vs Bot breakdown

Derived from the adaptive bot-score dataset — estimates with stated assumptions. The adaptive total (≈733M) counts more broadly than the billing rollup; ~361M were unscored (predominantly cached edge hits). Percentages are given as a share of scored traffic.

Verified good bots (Confirmed — verifiedBotCategory, ~79M total): Search Engine Crawler 29.1M · SEO 21.5M · Advertising & Marketing 20.4M · AI Crawler 5.07M · Security 1.62M · other <0.8M each.

Assumptions: (1) botScore < 30 = automated per Cloudflare guidance; (2) unscored traffic excluded from ratios (cache-dominated); (3) verified good bots reported separately as they legitimately score low. Takeaway: this is the most bot-dominated property reviewed — nearly two-thirds of scored traffic is automated, with a decisive human/bot split (only ~6% grey).

3. Cloudflare Protection Effectiveness

Observed firewall events over 30 days. Rule thresholds/bodies were not readable (403); ratings rest on observed action volumes.

3.1 Events by source (Confirmed)

3.2 Events by action (Confirmed, all sources)

managed_challenge 146.1M · skip 93.6M · block 60.8M · managed_challenge_bypassed 20.8M · managed_challenge_non_interactive_solved 8.10M · log 3.71M · managed_challenge_interactive_solved 2.43M · allow 46.7K.

3.3 Per-protection scorecard

Challenge math (Confirmed): 146.1M challenges issued, 10.53M solved → ~92.8% abandonment. A further 20.8M "bypassed" events are returning clients with valid clearance tokens (benign).

Managed WAF finding — the key differentiator (Confirmed): the managed phase is actively enforcing, producing 4.85M block events (dominated by managed rule 7bd01eec…, with a second OWASP-family rule 9c8dda97…). This gives the zone a signature-based backstop behind the custom rules — a layer of defense-in-depth. Because rule bodies were not readable (403), the breadth of OWASP/managed coverage (e.g., whether full anomaly scoring is enforced vs one high-value rule) could not be confirmed; worth verifying.

Rate-limiting finding (Confirmed): one rule (032c2edd…) fired ~887K times, entirely on /optout — protecting the DSAR/removal flow from abuse (correct and useful). However, the heavily-scraped /people/<name>/id/<id> record pages are not rate-limited; they rely on custom rules and challenges instead.

Security-level finding (Likely): no securitylevel events were observed, indicating reputation-based challenging is not active. The exact setting value returned 403 (Unknown), but its behavioral signature is absent.

4. Attack Analysis

(All Confirmed from 30-day firewall events unless noted.)

Top attacking countries (block events): Netherlands 11.25M · France 6.60M · United States 5.25M · Vietnam 5.09M · Germany 4.28M · Ireland 3.66M · Brazil 3.10M · Argentina 1.98M · Pakistan 1.28M · South Africa 1.18M · Bangladesh 1.17M · Colombia 0.90M. (NL dominant; unlike most properties, the US appears in the top three — some domestic scraping.)

Top attacking ASNs (operator names from public registries, not Cloudflare data — Likely): AS396982 Google Cloud 7.74M · AS14061 DigitalOcean 5.01M · AS29066 Velia.net (Germany) 4.78M · AS63949 Akamai/Linode 4.72M · AS45899 VNPT (Vietnam) 4.60M · AS32934 Meta/Facebook 4.04M · AS16509 Amazon AWS 3.74M · AS8075 Microsoft 0.92M · AS6147 Telefónica (Peru) 0.39M · AS43515 Google 0.39M · AS22927/AS7303 Telecom Argentina 0.34M/0.31M. Overwhelmingly cloud/hosting-based scraping; the large Meta ASN volume is notable (likely a crawler blocked/challenged at scale).

Top targeted paths (block events): /robots.txt 1.63M · /people/gulnara-griffin/id/f0211278263682782863 357.7K · /favicon.ico 211.9K · / 177.8K · /premium-link 164.2K · /api/v1/wam 146.3K (API) · a long tail of /people/<name>/id/<id> and /people/<name>/<city-state> person-record pages · /optout 5.29K. (Person-record enumeration is the dominant target.)

Top abusive IPs (block events): 92.204.248.55 (GoDaddy hosting) 4.65M · 63.32.23.121 (AWS Ireland) 1.41M · 52.215.186.214 (AWS Ireland) 981K · 54.194.183.189 (AWS Ireland) 868K · 35.212.115.150 (Google Cloud) 390K · 2001:1388:… (IPv6) 358K · 74.7.227.59 354K · DigitalOcean fleet (159.223.225.123, 209.38.104.65, 164.92.217.61) ~207–225K.

Top blocked user-agents (Confirmed): SirdataBot 9.72M (ad-tech crawler) · ias-ie/3.3 (Integral Ad Science) 4.68M (ad-verification crawler) · then generic Chrome UAs (116, 123, 120, 100) ~1.8M each. (The top two are commercial ad-tech crawlers — see note.)

Most common WAF detections (Confirmed): the managed WAF's blocks concentrate in managed rule 7bd01eec420fa0be30264603a5cb (4.85M) with a second rule 9c8dda97… (2.3K). On the custom side, one rule (a734ca1a…) accounts for 55.57M blocks (~91%). Rule names/expressions were not readable (403).

Most common rate-limit triggers (Confirmed): a single rule on /optout (378K challenges, plus solves) — the DSAR/removal flow. No other path is rate-limited.

Abuse-indicator summary

Ad-tech blocking note (Likely, needs business confirmation): the two largest blocked user-agents are legitimate commercial crawlers (Sirdata, Integral Ad Science). If these are ad/revenue partners meant to read the site, the custom rules may be over-blocking them; if intentional, this is working as designed. Confirm with the ad/revenue team.

5. Protection Coverage

✓ Enabled / Confirmed active

• Enterprise plan; Universal TLS certificates (Google Trust Services active, valid to 2026-09-10; Sectigo backup)
• Apex, www, pro, pro-dev, staging proxied (origin is AWS Elastic Beanstalk)
• Managed WAF actively enforcing (4.85M blocks) — a genuine signature-defense layer
• Custom firewall ruleset — the primary engine (~56M blocks + 146.1M challenges), actively tuned (v220)
• Rate limiting functional (v44) — protecting the /optout flow
• Bot Management — entitled and scoring live traffic; Managed Challenge in heavy use (92.8% abandon)
• DDoS L7 managed ruleset; URL Normalization; Exposed Credentials Check
• Clean DNS — production proxied, no real origin IP / admin panel / RFC1918 exposed
• http_config_settings phase present (per-rule config control)

⚠ Missing / weak protections

• Security-level reputation challenge — no securitylevel events observed; appears essentially off.
• Rate-limiting coverage is narrow — only /optout; the heavily-scraped /people/ record pages are not rate-limited.

⚠ Configuration to verify

• Managed-WAF breadth — the phase is enforcing, but blocks concentrate in one managed rule; confirm full OWASP/managed coverage (not just one high-value rule) is enabled. (rule bodies 403 — Unknown)
• Custom-rule concentration — ~91% of custom blocks come from one rule; backstopped by the managed WAF but worth spreading for resilience.

⚠ Unverifiable configuration (Unknown — 403)

• SSL/TLS mode, min-TLS version, HSTS, exact security-level value, Page Shield status, Bot Management action config. Verify with a settings-scoped token; Page Shield is worth confirming on a data-collection property. Certificates are Universal-only (no Advanced certificate).

6. Operational Risk: MEDIUM

Why MEDIUM (not HIGH):

• This is the best-defended property in the estate. It is the only one running an actively-enforcing managed WAF (4.85M blocks) on top of custom rules, managed challenges, rate limiting, DDoS L7, and Bot Management — genuine defense-in-depth rather than a single tier. (Confirmed)
• The perimeter is clean — production is proxied, and no real origin IP, admin interface, or RFC1918 is exposed, so the edge cannot be trivially bypassed. (Confirmed)
• Enforcement is highly effective — 54.0% of traffic 403'd, 92.8% challenge abandonment, foreign hostile traffic blocked at the edge; the WAF layer also provides attack telemetry the other properties lack. (Confirmed)

Why not LOW:

• Security level is off, removing a reputation-challenge layer. (Likely)
• Rate limiting is narrow (only /optout) — the heavily-scraped /people/ record and /api/v1/wam endpoints are not rate-limited. (Confirmed)
• Enforcement still concentrates — ~91% of custom blocks and the managed-WAF blocks each come from a single dominant rule; heaviest bot share in the estate (64% of scored traffic). (Confirmed)

7. Recommendations (evidence-prioritized)

Highest impact

1. Extend rate limiting to record and API endpoints. The /optout rule works well; add rules for /people/<name>/id/<id> and /api/v1/wam so a second mechanism throttles the confirmed record-scraping load rather than relying on the custom rule alone. Evidence: 887K rate-limit events, all on /optout; heavy /people/ scraping. — Low effort
2. Confirm and broaden managed-WAF coverage. The managed phase is enforcing (good) but blocks concentrate in one rule — verify full OWASP/managed rule coverage (anomaly scoring, injection/RCE families) is enabled so the signature backstop is comprehensive. Evidence: 4.85M managed blocks, dominated by one rule ID. — Low–Medium effort

Sustaining / resilience

1. Turn security level on to add a reputation-challenge layer ahead of the custom and managed rules. Evidence: zero securitylevel events. — Low effort
2. Reduce single-rule dependence on the custom side. Spread the dominant block logic across layered rules for resilience (the managed WAF already provides one backstop). Evidence: 91% of custom blocks from one rule. — Medium effort
3. Confirm the ad-tech bot policy (SirdataBot 9.7M, IAS 4.7M) with the revenue team — allow if they are partners, keep blocking if not. — Low effort

Verify (blocked by token scope this run)

1. Confirm SSL/TLS mode = Full (strict), min-TLS ≥ 1.2, HSTS enabled, and Page Shield status with a settings-scoped read token. — Low effort

None of these require new licensing — all sit within the existing Enterprise entitlement.

8. Executive Score: 75 / 100

Interpretation: The estate's strongest security posture. Genuine layered defense — active managed WAF + custom rules + challenge + rate limiting on a clean perimeter — effectively contains a heavy, cloud-based scraping campaign. Deductions are for an off security level, narrow rate-limiting coverage, and enforcement concentration.

Bottom line: fastbackgroundcheck.com is the reference standard among the properties reviewed — the only one where the managed WAF is actually enforcing, giving it real defense-in-depth (signature WAF + custom rules + bot challenge + rate limiting + DDoS L7) on a clean, fully-proxied perimeter. It contains a heavy, cloud-based scraping campaign effectively (54% of traffic 403'd, 92.8% challenge abandonment). The remaining work is incremental, not structural: extend rate limiting to record/API endpoints, confirm full managed-WAF coverage, and turn security level on — all within the current plan.