CDN only · Amazon Web Services
Amazon CloudFront
Difficulty 1/5
A CDN, not a bot defence. Worth identifying because it often fronts AWS WAF — and because on its own it stops nothing.
- TLS fingerprinting
- JS challenge required
- Behavioural scoring
- IP reputation weight: low
How it decides
-
Edge caching and TLS termination across Amazon’s POPs.
-
Optionally chained to AWS WAF, Shield or Lambda@Edge, which is where any actual filtering lives.
-
Geo-restriction rules, if the customer configured them.
What you see when it stops you
- `x-amz-cf-id` and `x-amz-cf-pop` headers
- `via: 1.1 …cloudfront.net`
Signatures the detector matches
Publicly observable artefacts Amazon CloudFront sends to every visitor. Paste a response into the analyser and these are what it looks for.
| Where | Signal | Weight |
|---|---|---|
| Header | x-amz-cf-id header | 60 |
| Header | x-amz-cf-pop edge location | 55 |
| Header | via: CloudFront | 55 |
What actually gets through
-
Nothing special. If you are being blocked behind CloudFront, the block comes from WAF or the origin.
-
Static ISP addresses are fine; concurrency is limited by the origin, not the edge.
Not sure this is what
is blocking you?
Paste the response you actually got. The detector names the vendor from its own headers, cookies and challenge markup — no account, nothing uploaded.