Cloudflare Security Effectiveness Assessment — usa-people-search.com

Scope: Single zone — usa-people-search.com (zone ID f34d7e0064d509259ce5296273cf7fba, Enterprise Website plan) Evidence window: Last 30 days (2026-06-25 → 2026-07-25)

1. Executive Summary

Modest traffic volume, actively filtered. The zone served 165.3M requests / 1.52 TB over 30 days — an order of magnitude smaller than the estate's flagship properties. Enforcement is aggressive: 44.6M requests (27.0%) were served a 403, the highest block proportion observed. (Confirmed)
Automation is roughly a third of scored traffic. Of ~149M scored requests, ~41% score as likely-human, ~37% automated, ~21% grey. Cloudflare flagged 11.3M requests as threats. US traffic is clean; foreign traffic (Vietnam, China, Bangladesh) runs at 95–99% threat rates. (Confirmed)
Cloudflare is containing abuse — but through a single tier. Custom rules generated 97.5M events (11.3M blocks + 22.1M challenges) and carry essentially all enforcement; the managed-challenge layer runs at an ~83.8% abandonment rate. (Confirmed)
Three protection layers are effectively inactive. The Managed WAF / OWASP ruleset fired only 140 times in 30 days (no meaningful enforcement or telemetry); rate limiting fired only 15,240 times (configured but negligible); and no security-level reputation challenges were observed (security level appears essentially off). (Confirmed / Likely)
Perimeter hygiene is excellent — the standout strength. DNS is clean (31 records): every production A/CNAME is proxied, and there is no exposed origin IP, no RFC1918 leakage, and no origin-bypass record. The edge cannot be trivially circumvented. (Confirmed)
Scraping is the dominant threat, from telco + cloud networks. Top block sources are China Unicom, VNPT/Viettel/FPT (Vietnam), Google Cloud, and Baidu's crawler — hitting the homepage, login/order pages, and their assets. (Confirmed)
Protection maturity: effective at the edge, shallow in depth. Bot management and custom rules work well; the signature WAF, rate limiter, and security-level challenge are not contributing. The zone depends on one enforcing layer. (Confirmed)
Overall risk: MEDIUM — a PII people-search property whose attack volume is well-contained and whose perimeter has no bypass path, but whose defense-in-depth is thin (custom rules are effectively the only enforcing tier). Executive score: 63/100.

2. Traffic Overview

30-day totals (Confirmed — httpRequests1dGroups)

Metric	Value
Total requests	165,311,692 (165.3M)
Cached requests	61,953,177 (37.5%)
Uncached requests	103,358,515 (62.5%)
Total bandwidth	1.52 TB
Encrypted (HTTPS) share	99.3%
Requests flagged "threat"	11,338,489 (~6.9%)

Edge response codes (Confirmed): 200 104.0M (62.9%) · 403 44.6M (27.0%) · 204 8.85M · 301 4.47M · 400 1.32M · 304 1.03M · 302 566K · 499 292K · 404 80K. The 27.0% 403 rate is the visible footprint of the (custom-rule-driven) security layer. No material 429 volume — rate limiting is not returning rate-limited responses at scale (see §3).

Human vs Bot breakdown

Derived from the adaptive bot-score dataset — estimates with stated assumptions. The adaptive total (≈305M) counts more broadly than the billing rollup; ~155.5M were unscored (predominantly cached edge hits). Percentages are given as a share of scored traffic.

Segment	Definition	Volume	% of scored
Likely human	botScore 80–99	61.7M	41.3%
Automated / bot	botScore 1–29	55.8M	37.3%
Grey / uncertain	botScore 30–79	32.0M	21.4%
(Unscored)	botScore 0 — mostly cached	155.5M	—

Verified good bots (Confirmed — verifiedBotCategory, ~43M total): AI Assistant 23.6M · AI Crawler 6.80M · Search Engine Crawler 5.46M · AI Search 3.22M · SEO 2.26M · Advertising & Marketing 0.70M · other <0.4M each. (AI-related traffic — Assistant + Crawler + Search ≈ 33.6M — is the dominant verified-bot load, a notable and growing pattern for this property.)

Assumptions: (1) botScore < 30 = automated per Cloudflare guidance; (2) unscored traffic excluded from ratios (cache-dominated); (3) verified good bots reported separately as they legitimately score low. Takeaway: the property leans slightly human, but automation is a large minority and foreign automated traffic is almost entirely hostile.

3. Cloudflare Protection Effectiveness

Observed firewall events over 30 days. Rule thresholds/bodies were not readable (403); ratings rest on observed action volumes.

3.1 Events by source (Confirmed)

Source	Events	Role
Custom rules (`firewallCustom`)	97,507,040	Primary — and effectively only — enforcement engine
IP rules (`ip`)	63,440	Minimal
Rate limiting (`ratelimit`)	15,240	Configured but negligible
Managed WAF (`firewallManaged`)	140	Effectively inactive
(Security Level)	0 observed	No reputation challenges firing (Likely off)

3.2 Events by action (Confirmed, all sources)

skip 40.56M · managed_challenge 22.09M · managed_challenge_bypassed 19.96M · block 11.34M · managed_challenge_non_interactive_solved 2.52M · managed_challenge_interactive_solved 1.06M · allow 63.4K. (No log-mode action of note — posture is challenge/block.)

3.3 Per-protection scorecard

Protection	Events	Blocks	Challenges	Allowed/Skip	Est. effectiveness	Rating
Custom Rules	97.5M	11.34M	22.09M issued	40.56M skip	Terminal blocks enforced; carries the whole zone	Excellent
Managed WAF (Cloudflare Managed Ruleset)	140	140	—	—	Deployed but effectively not executing	Missing (enforcement)
OWASP Core Ruleset	within 140	~0	—	—	Not contributing	Missing (enforcement)
Rate Limiting	15,240	20	~15.2K (challenge)	—	Configured but negligible volume	Needs Improvement
Bot Management	drives challenges	via rules	22.09M	—	Scoring active; 83.8% challenge-abandon	Good
Managed Challenge	22.09M issued	—	22.09M	3.58M solved	~83.8% did not solve → effective deterrence	Good
JS Challenge	not observed	—	—	—	Not in use (managed challenge used)	N/A
Security Level	0 observed	—	0	—	No reputation challenges firing	Missing / Off (Likely)

Challenge math (Confirmed): 22.09M challenges issued, 3.58M solved → ~83.8% abandonment. A further 19.96M "bypassed" events are returning clients with valid clearance tokens (benign).

Managed WAF finding (Confirmed): the Cloudflare Managed Ruleset (v377) and OWASP Core Ruleset (v88) are present in the ruleset inventory but generated only 140 firewall events in 30 days — effectively no execution against live traffic. There is therefore no active signature-based defense (injection, RCE, path-traversal, known-CVE) and no WAF-layer attack telemetry. Such attacks are stopped only if a custom rule happens to match.

Rate limiting finding (Confirmed): the rate-limit phase (v24) is deployed with 2–3 rules, but they fired only 15,240 times total over 30 days via managed challenge. Given confirmed foreign scraping pressure, this is effectively not protecting the search/order/asset endpoints — thresholds are likely too high or scope too narrow.

Security-level finding (Likely): no securitylevel-sourced events were observed, which indicates reputation-based challenging is not active (security level appears set to essentially off). The exact setting value returned 403 (Unknown), but its behavioral signature is absent.

4. Attack Analysis

(All Confirmed from 30-day firewall events unless noted.)

Top attacking countries (block events): Vietnam 1.74M · China 1.58M · Bangladesh 1.02M · Brazil 567K · Netherlands 520K · Indonesia 421K · Malaysia 340K · Nepal 301K · France 301K · India 270K · Thailand 252K · UAE 225K. (US does not appear — US traffic is clean; blocks are almost entirely foreign.)

Top attacking ASNs (operator names from public registries, not Cloudflare data — Likely): AS4837 China Unicom 1.44M · AS45899 VNPT (Vietnam) 1.26M · AS396982 Google Cloud 466K · AS7552 Viettel (Vietnam) 328K · AS4788 TM Net (Malaysia) 199K · AS5384 Etisalat (UAE) 182K · AS18403 FPT (Vietnam) 123K · AS29066 (hosting) 120K · AS9121 Türk Telekom 105K · AS9299 PLDT (Philippines) 101K · AS7713 Telkom (Indonesia) 99K · AS132203 Tencent 99K. A mix of Asian consumer telcos and cloud/hosting networks.

Top targeted paths (block events): / 2.59M · /css/login.css 88.6K · a cluster of /build/css/* and /build/js/* static assets (jQuery, bootstrap, form-validation — bots rendering full pages) · /favicon.ico 77.3K · /order.aspx 53.0K (purchase flow). (The .aspx extension indicates an ASP.NET/Windows origin behind the AWS front.)

Top abusive IPs (block events): 92.204.248.55 (GoDaddy hosting) 118.3K · 63.32.23.121 (AWS) 13.3K · 54.194.183.189 (AWS) 9.9K · 185.177.72.49 7.6K · 116.179.37.0/24 (Baidu, China) — a cluster of IPs at ~7K each · 52.215.186.214 (AWS) 7.2K. (Volumes are low, consistent with the zone's overall scale.)

Top blocked user-agents (Confirmed): generic Chrome-120/Mac 5.05M (spoofed) · Baiduspider-render/2.0 935K · Chrome 148/146/145 ~470–515K each · Firefox 133/135 ~464K each · a Baiduspider iPhone variant 335K. (Pattern: high-volume identical spoofed browser UAs + Baidu's crawler, ~1.27M combined Baidu blocks.)

Most common "WAF" detections (Confirmed): because the managed WAF is inactive, all blocks come from custom rules. One rule — 3543248592b5425ca7a22eef60cdbbe6 — accounts for 9.81M blocks (~86% of all blocks); rule 9b9f96bc… blocks 1.44M (matching AS4837 China Unicom); remaining rules <100K. Rule names/expressions were not readable (403).

Most common rate-limit triggers (Confirmed): rules e66e1848… (~11.3K challenges) and 8beec17a… (~0.9K) — total volume negligible; no path materially protected.

Abuse-indicator summary

Indicator	Evidence	Tier
Scraping	Foreign telco/cloud ASNs at 95–99% threat rate; high-volume spoofed browser UAs; full-page asset pulls; Baidu crawler blocked ~1.27M	Confirmed
Enumeration	Homepage + asset harvesting at scale; no deep person-record path enumeration surfaced in top blocks	Possible
Login / auth interest	`/css/login.css` and jQuery-validation assets appear in blocks — automated access to login/form pages	Possible
Purchase-flow interest	`/order.aspx` blocked 53.0K — automated traversal of the order page	Possible
Credential abuse	No login POST/auth-endpoint signal in block or rate-limit data	Unknown / no evidence
Authenticated abuse	Not observable from edge data — requires backend session/account correlation	Unknown
Injection/exploit attempts	Would be caught by the managed WAF/OWASP — but that layer is inactive, so such attempts are neither detected nor recorded	Unknown (blind spot)

Two evidence limits: (1) Cloudflare edge data cannot confirm account-level or authenticated abuse — that needs backend correlation. (2) With the managed WAF inactive, the zone has no telemetry on signature-based attacks — their absence here is a visibility gap, not proof they aren't occurring.

5. Protection Coverage

✓ Enabled / Confirmed active

Enterprise plan; Universal TLS certificates (Google Trust Services active, valid to 2026-10-07; Let's Encrypt backup)
Apex + www and all product subdomains (aegis, articles, names, dev, stage) proxied
Excellent DNS hygiene — 31 records, every production A/CNAME proxied, no exposed origin IP, no RFC1918, no origin-bypass record
Custom firewall ruleset — the enforcement engine (11.34M blocks + 22.09M challenges), updated recently (v119)
Bot Management — entitled and scoring live traffic; Managed Challenge in active use (83.8% abandon)
Cloudflare Managed Ruleset (v377), OWASP Core (v88), Exposed Credentials Check, DDoS L7 — deployed (but see gaps)
URL Normalization; 99.3% encrypted traffic

⚠ Missing / inactive protections

Managed WAF / OWASP enforcement — deployed but effectively not executing (140 events / 30 days). No signature defense, no WAF telemetry.
Security-level reputation challenge — no securitylevel events observed; appears essentially off.

⚠ Weak configuration

Rate limiting — deployed but negligible (15,240 events); not protecting the scraped endpoints despite confirmed foreign scraping.
Single-tier dependence — custom rules are effectively the only enforcing layer; no signature or reputation backstop.
Only Universal certificates (no Advanced certificate) — functional, but fewer options for advanced TLS control.

⚠ Unverifiable configuration (Unknown — 403)

SSL/TLS mode, min-TLS version, HSTS, exact security-level value, Page Shield status, Bot Management action config. Verify with a settings-scoped token; Page Shield is worth confirming on a data-collection property.

6. Operational Risk: MEDIUM

Why MEDIUM (not HIGH):

The perimeter has no bypass path. Unlike properties that expose origin IPs or unproxied subdomains, every production record here is proxied and no origin/RFC1918 detail is published. An attacker cannot easily route around the Cloudflare edge to reach the origin directly. (Confirmed)
Attack volume is modest and well-contained. 165.3M requests, 27.0% served 403, 83.8% challenge abandonment, foreign hostile traffic blocked at the edge. There is no edge evidence of successful mass exfiltration. (Confirmed)
Bot management + custom rules are demonstrably effective at the scraping threat that actually targets this zone. (Confirmed)

Why not LOW:

Defense-in-depth is thin. The managed WAF/OWASP is inactive (140 events), rate limiting is negligible (15.2K events), and security-level challenging appears off. On a PII people-search property, the custom-rule tier is effectively a single point of failure — a gap in one rule has no signature or reputation backstop, and there is no WAF-layer visibility into injection/exploit attempts. (Confirmed)

What would elevate this to HIGH: any origin-bypass exposure (unproxied origin record), evidence of injection/exploit success (currently invisible due to the WAF gap), or a material rise in attack volume against the single enforcing tier.

7. Recommendations (evidence-prioritized)

Highest impact

Activate managed-WAF enforcement. Bring the Cloudflare Managed Ruleset + OWASP Core Ruleset into active execution (block for high-confidence signatures; brief log-then-tune for the rest). This adds the missing signature-defense tier and the attack telemetry the zone currently lacks. Evidence: 140 managed events in 30 days. — Low–Medium effort
Make rate limiting effective on the scraped/sensitive endpoints. Add/retune rules for the search, /order.aspx, login, and asset-heavy paths so they actually trigger under the confirmed foreign-scraping load. Evidence: 15,240 rate-limit events total; login/order pages appear in blocks. — Low effort

Sustaining

Turn security level back on (or set an appropriate reputation challenge). Restore the reputation-based challenge layer so known-bad IPs are challenged before reaching the custom rules. Evidence: zero securitylevel events observed. — Low effort
Preserve the DNS hygiene. The clean, fully-proxied DNS is this zone's strongest control — keep new records proxied and avoid publishing origin IPs as the property grows. Evidence: 31 records, no bypass path. — Low effort (governance)

Verify (blocked by token scope this run)

Confirm SSL/TLS mode = Full (strict), min-TLS ≥ 1.2, HSTS enabled, and Page Shield status with a settings-scoped read token. — Low effort

None of these require new licensing — all sit within the existing Enterprise entitlement.

8. Executive Score: 63 / 100

Interpretation: Effective at the edge, shallow in depth. A clean perimeter and a strong custom-rule + bot-challenge tier keep a modest scraping campaign contained; the score is held back by an inactive signature WAF, negligible rate limiting, and an off security level.

Dimension	Assessment	Deduction
Cloudflare coverage	Full ruleset stack deployed + BM entitlement + fully-proxied DNS	—
Configuration consistency	Excellent DNS hygiene; no origin-bypass path	— (strength)
WAF maturity	Managed WAF + OWASP deployed but inactive (140 events, 0 real enforcement)	−15
Rate limiting	Deployed but negligible (15.2K events); not protecting scraped endpoints	−10
Bot protection	Scoring active; 83.8% challenge abandonment	small
Layered defenses	Custom rules the only enforcing tier; no signature or reputation backstop	−5
Security level	No reputation challenges firing (appears off)	−4
Observed attack success	Well-contained (27% 403, 83.8% abandon); no edge evidence of exfiltration	small
Verification gaps	Page Shield / TLS mode / HSTS unconfirmed (token scope); Universal-only certs	−3
Total		≈ −37 → 63/100

Bottom line: usa-people-search.com has the cleanest perimeter of the properties reviewed — fully proxied DNS with no origin-bypass path — and its custom-rule and bot-challenge enforcement is effectively containing a modest, foreign-sourced scraping campaign. The gap is depth: the signature WAF is dormant, rate limiting is negligible, and the security-level challenge is off, leaving the custom-rule tier as a single point of failure with no WAF-layer visibility. Activating the managed WAF and making rate limiting effective — both inside the current plan — would restore layered defense and lift the score materially.