telemetry.evilbyte.net

Rating distribution

Every distinct requestor currently on file, bucketed by §3.3's bands.

Does the formula track Cloudflare's own signals?

Average Bot Management score and WAF attack score, grouped by the same bands above. Neither one is a formula input — §4.5.2's "Presumption of Evil" stands unmodified — they're recorded purely for comparison. If the Evil Rating means anything, the Evil/Saturated Evil bands should skew toward Cloudflare's own bot/attack scores too.

Top Autonomous Systems

By distinct-requestor count. F_AS comes from the ERA, not from this table.

By zone

By distinct-requestor count, across every zone on the account.

Methodology & known gaps

This pipeline reconstructs the six factors from historical log rows, not from a live request — a few of them are necessarily approximations of what the live MITM would compute in the moment.

• F_time is estimated from the requestor's country (and, for a handful of large countries, region) rather than Cloudflare's own per-IP geolocation timezone — large countries spanning multiple zones (the US, Russia, Canada, Australia, Brazil) are the most likely to be misjudged near band edges.
• F_name reuses a reverse-DNS answer for up to 7 days rather than looking it up fresh every time, so a requestor's name factor can lag a recent PTR change.
• F_AS and F_name both fall back to their unrated defaults (1.0 / 1.25) when a run has too many new requestors to look all of them up in time — those rows are flagged internally and topped up on a later run.
• Bot Management score, WAF attack score, and JA4 are stored for comparison only and never feed the formula.
• "By zone" stays empty if this Cloudflare account's Log Explorer doesn't report a zone field on account-wide queries — see telemetry/README.md.