```json
{
    "title": "Enterprise Shield – Top Offenders – 2026-07-22",
    "url": "https://performancezen.com/2026/07/23/enterprise-shield-top-offenders-2026-07-22/",
    "datePublished": "2026-07-23",
    "dateModified": "2026-07-23",
    "language": "en-US",
    "description": "Ah, Cloudflare. You claim to be security focused and help customers block threats to their sites, including unwanted bots. So, when are you going to clean your own house? This…",
    "author": "spierzchala",
    "publisher": "Performance Zen"
}
```

# Enterprise Shield – Top Offenders – 2026-07-22

Ah, [Cloudflare](https://www.cloudflare.com/). You claim to be security focused and help customers block threats to their sites, including unwanted bots. So, when are you going to clean your own house?

This week, like last week, the single largest source of traffic captured by my firewall was, again, [AS13335 - Cloudflare WARP](https://ipinfo.io/AS13335). The firewall blocked nearly 4x the amount of hits when compared to the next closest ASN; and that was from just one of their ASNs.

When the data is sorted by the number of unique IPs hitting the server, Cloudflare comes first **and** second, with [AS14789](https://ipinfo.io/AS14789) contributing a smaller number of hits.

![Top ASNs - By Hits - Last 7 Days](https://performancezen.com/wp-content/uploads/2026/07/Screenshot-From-2026-07-22-21-05-57.png)
Top ASNs - By Hits - Last 7 Days

![Top ASNs - By Unique IPs - Last 7 Days](https://performancezen.com/wp-content/uploads/2026/07/Screenshot-From-2026-07-22-21-09-15.png)
Top ASNs - By Unique IPs - Last 7 Days

You can see the scope of the unwanted traffic from Cloudflare WARP even more clearly when it is charted.

![Top ASNs - By Hits - Last 7 Days](https://performancezen.com/wp-content/uploads/2026/07/Screenshot-From-2026-07-22-21-14-55.png)
Top ASNs - By Hits - Last 7 Days

Since the last update, I have had to add a large number of Cloudflare CIDR blocks to my `penalty_box` list that is before the `shield_hyperscaler` rules in my firewall rules. The **Penalty Box** is a complete drop rule, with a time limit. Unfortunately, pretty much all the CIDR blocks in the `penalty_box` qualify for permanent blocks, and I will likely move them their in the near future.

You can see when I migrated the Cloudflare CIDR Blocks to the `penalty_box` ruleset in these time charts -- the red items are `shield_hyperscaler` while the purple is `penalty_box` (I apologize to my brethren who have red/green color blindness).

![Hits by Ruleset - Last 7 Days](https://performancezen.com/wp-content/uploads/2026/07/Screenshot-From-2026-07-22-21-18-38.png)
Hits by Ruleset - Last 7 Days

![Unique IPs by Ruleset - Last 7 Days](https://performancezen.com/wp-content/uploads/2026/07/Screenshot-From-2026-07-22-21-21-32.png)
Unique IPs by Ruleset - Last 7 Days

I will continue to watch this over the next few weeks; if Cloudflare WARP continues to be this aggressive, they will end up in the permanent block ruleset.