Cloudflare Security Effectiveness Assessment — peoplefinders.com

Scope: Single zone — peoplefinders.com (zone ID 833516b13d885c526c022c7f7234f7ae, Enterprise Website plan) Evidence window: Last 30 days (2026-06-25 → 2026-07-25)

1. Executive Summary

• Very high traffic, very high automation. The zone served 1.53 billion requests / 49.2 TB over 30 days. Of requests that received a bot score, ~55% scored as automated (bot) and only ~29% as likely-human — this is a heavily targeted property. (Confirmed)
• Attack/scraping activity is large and sustained. Cloudflare flagged 96.2M requests as threats; 178.3M requests (11.7%) were served a 403; the security layer generated ~66M hard blocks and ~69M challenges in 30 days. Foreign telco/cloud networks (Vietnam, China, Bangladesh, Brazil) run at near-100% threat rates. (Confirmed)
• Cloudflare is actively and effectively mitigating the bulk of abuse — via custom rules and bot challenges. Custom firewall rules generated 922.6M events; challenged clients abandoned ~94.7% of the time (strong bot deterrence). This is the zone's real defensive engine and it is working. (Confirmed)
• The managed WAF is deployed but not enforcing. The Cloudflare Managed Ruleset + OWASP Core Ruleset are present, but 92.6% of their detections are log-only (15.5M logged vs 1.23M blocked). Detection is strong; enforcement is largely off. (Confirmed)
• Rate limiting is effectively absent where it matters. The only rate-limit rule observed is log-only and scoped to /opt-out (the DSAR/removal flow). High-value search, checkout, and API endpoints — the confirmed scraping targets — have no enforcing rate limit. (Confirmed)
• The API bypasses the edge entirely. api.peoplefinders.com resolves unproxied directly to origin 204.44.57.34, so WAF, bot management, and rate limiting do not apply to it. (Confirmed)
• Origin topology is exposed in public DNS. Origin IP ranges (204.44.57.0/24, 38.113.121.0/24) and internal RFC1918 addresses (192.168.8.182, 192.168.8.99, 192.168.7.64) are published in public records, enabling origin-direct WAF bypass and reconnaissance. (Confirmed)
• Overall risk: HIGH — driven by a PII/payments property under confirmed heavy scraping, an unproxied API surface, origin exposure, and non-enforcing WAF/rate-limit layers. This is partially compensated by genuinely strong custom-rule and bot-challenge enforcement, which is why it is not CRITICAL. Executive score: 65/100.

2. Traffic Overview

30-day totals (Confirmed — httpRequests1dGroups)

Edge response codes (Confirmed): 200 1.296B (84.8%) · 403 178.3M (11.7%) · 301 19.4M · 302 9.75M · 404 8.0M · 304 7.7M · 204 6.46M · 499 2.42M (client-abandoned) · 520 167K (origin errors). The 11.7% 403 rate is the visible footprint of the security layer (blocks + challenge pages).

Human vs Bot breakdown

Cloudflare does not expose a single "human/bot" total; the figures below are derived from the adaptive bot-score dataset and are estimates with stated assumptions. Note the adaptive dataset counts on a broader basis than the billing rollup above (adaptive 30-day total ≈ 3.19B, of which ~1.64B were unscored — predominantly cached edge hits that never reach the bot engine). Percentages below are therefore given as a share of scored traffic to avoid the unscored distortion.

Verified good bots (Confirmed — verifiedBotCategory, ~674M total): Advertising & Marketing 450.5M · Search Engine Crawler 119.2M · AI Crawler 53.2M · SEO 25.1M · AI Search 12.9M · AI Assistant 7.1M · Security 3.0M · other <2M each.

Assumptions: (1) botScore < 30 is treated as automated per Cloudflare's standard guidance; (2) unscored traffic is excluded from ratios because it is dominated by cached responses, not human sessions; (3) "verified good bots" overlap the low-botScore band (verified crawlers legitimately score low) and are therefore reported separately, not added to the malicious-bot count.

Takeaway: Even excluding unscored traffic, automated clients outnumber humans roughly 2:1. This is consistent with a high-value people-search/PII dataset under continuous commercial scraping.

3. Cloudflare Protection Effectiveness

Figures are observed firewall events over 30 days (firewallEventsAdaptiveGroups). Rule thresholds/bodies were not readable (403), so ratings rest on observed action volumes.

3.1 Events by source (Confirmed)

3.2 Events by action (Confirmed)

skip 653.1M · jschallenge_bypassed 94.4M · block 65.7M · managed_challenge 39.3M · managed_challenge_bypassed 39.0M · jschallenge 30.4M · log 15.6M · jschallenge_solved 1.99M · managed_challenge_non_interactive_solved 1.23M · allow 1.05M · managed_challenge_interactive_solved 0.50M.

3.3 Per-protection scorecard

Challenge math (Confirmed): 69.5M challenges issued (39.1M managed + 30.4M JS). 3.69M solved → ~94.7% abandonment, the clearest single indicator that bot-challenge enforcement is working. A further 131.9M "bypassed" events are returning clients presenting a valid clearance token (expected, benign).

Managed WAF enforcement gap (Confirmed): within the managed layer, log 15.5M vs block 1.23M → only 7.4% of managed-WAF detections are enforced. A single managed rule (6179ae15870a4bb7b2d480d4843b323c) accounts for 15.5M log events. This means the OWASP/managed layer is currently a monitoring instrument, not a control — if a threat slips past the custom rules, the managed layer will record it but not stop it.

4. Attack Analysis

(All Confirmed from 30-day firewall events unless noted.)

Top attacking countries (block events): Vietnam 8.95M · Bangladesh 5.62M · Brazil 5.42M · China 3.65M · Philippines 2.81M · Malaysia 2.36M · India 2.31M · United States 2.29M · Indonesia 2.14M · Russia 1.97M · Nepal 1.70M · UAE 1.67M. (In raw traffic, VN/CN/BD/BR/MY show 96–99.7% threat rates — these networks are almost entirely hostile.)

Top attacking ASNs (operator names from public ASN registries, not Cloudflare data — Likely): AS45899 VNPT (Vietnam) 6.27M · AS4837 China Unicom 1.84M · AS7552 Viettel (Vietnam) 1.70M · AS17639 Converge ICT (Philippines) 1.61M · AS4788 TM Net (Malaysia) 1.44M · AS5384 Emirates/Etisalat (UAE) 1.40M · AS14618 Amazon AWS 1.21M · AS13238 (Yandex) 1.01M · AS23724 China Telecom 0.81M · AS207990 0.78M · AS18403 FPT (Vietnam) 0.78M.

Top targeted paths (block events): / 11.86M · /products/name 1.31M · /checkout/background-check 1.07M · /address/records 846K · /phone/loading 700K · /favicon.ico 300K · /peoplesearch/searchresults 287K · /reverse-phone/searchresults 207K · /address/search 122K · /loading/background-check 121K · /checkout/people 44.8K · /api/directory/session 34.8K.

Top abusive IPs (block events): 3.228.162.54 (AWS us-east-1) 1.21M · 143.44.165.231 1.09M · 143.44.165.49 262K · 104.28.39.128 88.5K · 220.181.51.0/24 (Baidu range) — a dozen IPs at ~28–33K each.

Most common WAF detections (Confirmed by rule ID; names not resolvable — token 403 on rule bodies): managed rule 6179ae15870a4bb7b2d480d4843b323c dominates (15.5M, log). Remaining managed rules each <300K.

Most common rate-limit triggers (Confirmed): a single log-only rule (1b15191e2419468a859c1a08b75adc0e) on the /opt-out / removal-request flow and its static assets. No rate-limit rule fired on search, checkout, or API paths.

Abuse-indicator summary

Evidence limit: Cloudflare edge data cannot confirm account-level or authenticated abuse — that needs backend session correlation. Do not infer account compromise from these figures alone.

5. Protection Coverage

✓ Enabled / Confirmed active

• Enterprise plan; Advanced TLS certificate (Google Trust Services, *.peoplefinders.com, valid to 2026-09-17, auto-managed)
• Production apex + www proxied through Cloudflare (origin 38.113.121.126)
• Custom firewall ruleset — heavily used, updated daily (version 6474)
• Cloudflare Managed Ruleset (v377) + OWASP Core Ruleset (v88) — deployed
• DDoS L7 managed ruleset; URL Normalization; Exposed Credentials Check ruleset
• Bot Management — entitled and scoring live traffic (botScore populated)
• Managed Challenge + JS Challenge — active and effective
• HTTPS near-universal (99.2% encrypted)

⚠ Missing / not enforcing

• Enforcing rate limiting on search, checkout, and API endpoints (only a log-only /opt-out rule exists)
• WAF enforcement — managed/OWASP rules run 92.6% in log mode

⚠ Inconsistent configuration

• api.peoplefinders.com is unproxied (edge bypass) while apex/www are proxied
• QA lanes (lane*.qa4.peoplefinders.com) are proxied and internet-exposed, and are receiving/blocking attack traffic

⚠ Weak configuration

• Origin IP ranges (204.44.57.0/24, 38.113.121.0/24) and internal RFC1918 addresses published in public DNS
• Unverifiable this run (Unknown): SSL/TLS mode, min-TLS version, HSTS, security level, Page Shield status, Bot Management action config — token returned 403. These should be confirmed with a settings-scoped token; Page Shield on a payment-handling property is a known common gap and worth explicit verification.

6. Operational Risk: HIGH

Why HIGH (not MEDIUM):

1. Unprotected API surface — api.peoplefinders.com bypasses WAF/bot/rate-limit entirely; on a property serving PII and payments this is a direct, unmonitored attack path. (Confirmed)
2. Origin-direct bypass is enabled — published origin ranges + internal RFC1918 addresses let an attacker attempt to reach origin behind the edge; the production origin /24 is discoverable. (Confirmed)
3. No enforcing rate limit on the exact endpoints being scraped — search/checkout/API are hit millions of times yet only /opt-out has a (log-only) limiter. (Confirmed)
4. Defense-in-depth is shallow — the managed WAF/OWASP layer logs but does not block, so the custom-rule layer is effectively the only enforcing tier. A gap in custom rules has no backstop. (Confirmed)
5. Confirmed, sustained, high-volume scraping of a sensitive-data product from hostile networks. (Confirmed)

Why not CRITICAL: The custom-rule + bot-challenge layer is demonstrably effective (66M blocks, 69M challenges, 94.7% challenge abandonment, 11.7% of all traffic 403'd). There is no edge evidence of successful mass exfiltration through the proxied path, and TLS coverage is near-universal. The exposure is real but actively contested on the main path.

7. Recommendations (evidence-prioritized)

Do this quarter — highest impact

1. Proxy the API or put dedicated protection in front of it. api.peoplefinders.com (→204.44.57.34) currently bypasses every Cloudflare control. Either enable the orange-cloud proxy or front it with mTLS/token auth + rate limiting. Evidence: unproxied DNS record + API session paths appearing in block logs. — Medium effort
2. Add enforcing rate limits on search, checkout, and API paths. Target the confirmed scraping endpoints (/peoplesearch/searchresults, /reverse-phone/searchresults, /address/records, /products/name, /checkout/*, /api/*). The entitlement already exists (a rate-limit rule is deployed for /opt-out). Evidence: 99,560 rate-limit events total, all log-only, none on these paths. — Low effort
3. Move the managed WAF / OWASP ruleset from log to block (or block for high-confidence signatures, starting with the dominant rule 6179ae…). This restores the second enforcement tier. Roll out per-rule to manage false positives. Evidence: 92.6% of 16.7M managed detections are log-only. — Low–Medium effort

Do this quarter — exposure reduction

1. Remove internal/origin detail from public DNS. Drop or split-horizon the RFC1918 records (cid, cid2, lane*.qa.wam, stage4) and reduce unproxied origin-range exposure where those hosts don't require direct reachability. Restrict origin firewalls to Cloudflare IP ranges so published origin IPs can't be hit directly. Evidence: 192.168.x.x + 204.44.57.0/24 / 38.113.121.0/24 in public records. — Medium effort
2. Decide QA-lane exposure. lane*.qa4 are proxied and taking internet attack traffic; put them behind Cloudflare Access or de-proxy/firewall them off the public internet. — Low–Medium effort

Verify (blocked by token scope this run)

1. Confirm SSL/TLS mode = Full (strict), min-TLS ≥ 1.2, HSTS enabled, and Page Shield status with a settings-scoped read token. On a payment-handling zone, Page Shield (client-side/Magecart protection) should be explicitly verified. — Low effort

8. Executive Score: 65 / 100

Interpretation: Moderate–good maturity. Strong, actively-working edge enforcement on the primary path, undercut by non-enforcing secondary layers and material origin/API exposure.

Bottom line: peoplefinders.com is a heavily attacked, high-value PII property whose custom-rule and bot-challenge defenses are genuinely effective — that is the reason the score is not lower. The path to a materially higher score is narrow and achievable: protect the API, turn on enforcing rate limits for search/checkout/API, switch the managed WAF from log to block, and close the origin/DNS exposure. None of these require new licensing; all are within the existing Enterprise entitlement.