DDoS

A customer’s firewall flagged thousands of inbound sessions to a cPanel web server and the team declared the VM compromised. Every session came from Cloudflare’s own ranges. The real event was a browser-mimicking GET flood that the free plan passed straight to origin, and the Security Events log looked almost empty. Here is how to read the edge before you touch the VM, and what a real compromise looks like instead.