Stop Chasing
False Positives

{
  "indicator": "cloudflare.com",
  "status": "whitelisted",
  "type": "domain",
  "confidence_score": 100,
  "confidence_level": "very_high",
  "source_count": 8,
  "risk_level": "info",
  "risk_context": "CDN Security",
  "risk_description": "Cloudflare is a major CDN and security provider protecting over 25 million websites. This IP is part of their anycast edge network. While Cloudflare can proxy both legitimate and malicious sites, blocking Cloudflare IPs causes significant collateral damage affecting millions of services.",
  "verdict": "likely_benign",
  "recommendation": {
    "action": "allow_with_logging",
    "false_positive_likelihood": "very_high",
    "investigation_hint": "Check the HTTP Host header or SNI to identify the actual website being accessed."
  },
  "provider": {
    "name": "Cloudflare",
    "type": "cdn_security",
    "services": [
      "CDN",
      "WAF",
      "DDoS Protection",
      "DNS",
      "Zero Trust"
    ]
  },
  "reasons": [
    "Ranked within top 1K of Cisco Umbrella list.",
    "Ranked within the top 1K entries of the Majestic Million list (ranked by referring subnets).",
    "Cloudflare - Major CDN provider corporate infrastructure.",
    "Top 500 domains according to Moz – commonly legitimate high-traffic domains.",
    "Ranked within top 1K of Majestic Million list.",
    "Ranked within the top 1K entries of the Cisco Umbrella 1M list.",
    "Ranked within the top 1K entries of the Tranco 1M list.",
    "Ranked within top 1K of Tranco list."
  ],
  "categories": [
    "CDN",
    "Cloudflare",
    "Enterprise",
    "High Traffic",
    "Popular Domain",
    "SEO Ranking",
    "Security Service",
    "Top 50K"
  ]
}