Here is a question we could not answer well a year ago: what really happens with how to hide your origin IP properly? We can answer it now.
Lessons for your own runbook
Know who can change DNS at two in the morning. Know your origin IPs and who can rotate them. Know which routes are expensive, and have a rate limit ready for each of them.
Most outages during attacks are not caused by the attack itself but by rushed changes made while under pressure.
The numbers
Across the last quarter, 71% of challenged clients never attempted a solution, 24% solved one challenge and then behaved normally, and 5% solved challenges repeatedly while continuing to attack — the last group is where analysts spend their time.
Median added latency for legitimate visitors that were challenged was 280 ms on desktop and 410 ms on mid-range Android devices.
Compliance is a side effect
Regulators increasingly ask for evidence of resilience, not just promises. An incident timeline with start, peak, vectors and impact is exactly the evidence DORA and NIS2 ask for — and it falls out of good observability for free.
We export incident reports in formats auditors can file without anyone rewriting them.
What we got wrong
Our first version challenged too eagerly on mobile networks, where thousands of real users share a handful of carrier-grade NAT addresses. Reputation that is shared is reputation that is noisy.
We now weight fingerprint consistency and session behaviour far more heavily than IP reputation for traffic from known mobile carrier ranges.
{ "match": { "path": "/account/reset", "risk": ">= 68" }, "action": "challenge" }
If you run into any of this in your own environment, our SOC is happy to take a look — even if you are not a customer.
The point about origin IPs leaking through certificate transparency logs is underrated.
Do you publish the edge IP ranges in a machine-readable format?
How does the proof-of-work challenge behave on older Android devices? Any numbers below Android 10?
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.
Thanks — sharing this with our on-call team.
Any plans to support per-tenant limits keyed on a JWT claim?
Verified good bots and allow-listed partners bypass challenges entirely.
Would love a follow-up on how you handle HTTP/3 fingerprinting.
How do you avoid challenging uptime monitors and partners?
We had the exact false-positive issue with CGNAT carriers. The weighting change makes sense.