Cloudflare and malicious bots, score, challenge, origin off the internet
Opselis
Credential stuffing, cart scanning and price scraping. Bot score, JS challenge and a WAF rule, before traffic reaches the store. Origin without a public address, and a playbook that says when to raise the threshold.
A bot does not look like an SQL attack. Often it is a clean GET on /login, /cart or /api/products, repeated from many IPs. In the application log you see a jump in 4xx. In Cloudflare you see the bot score, JA3 and whether the edge issued a JS challenge or passed the request to origin.
We start with a map of paths: login, cart, search, payment webhooks. Verified bots (search, monitoring) stay on allow. Traffic with a low bot score gets a JS challenge or a block. Origin has no public address. DNS and TLS terminate at the edge.
A rule without context breaks checkout. That is why we look at sampled logs, not only the chart. If the challenge catches real customers behind a corporate proxy, we narrow the condition: path, ASN, fingerprint, not the whole hostname.
The outcome can be billed: fewer attempts on /login, the same cart response time, no surprises at the payment gateway. On-call gets a playbook for when to raise the threshold, and when to leave the challenge.