CLIENT-ADDRESS EVIDENCE REVIEW

Scope: hostname, observation layer, date range, timezone and landing path.

Topology: browser -> CDN -> load balancer -> origin. Record every actual hop.
Transport peer: field captured before any address rewriting, with its source.
Header: exact selected header, duplicates, serialization and any transformations.
Trust: verified proxy CIDRs, owner, reference, update date and direct-origin policy.
Cloudflare: check Workers, header transforms and Pseudo IPv4 mode if applicable.

Export: use peer_ip, headers, method and request_target; one JSON object per line.
Preserve repeated header fields as an array or duplicate case variants for review;
do not silently collapse repeated headers into one chosen value. Array values are
unresolved in this reviewer. Duplicate literal JSON keys are a file error.
Do not relabel an already rewritten remote address as the original transport peer.

Findings: records resolved under supplied trust, peer-only records, unresolved
reasons and lines eligible for the builder. Preserve the original export separately.
The first untrusted forwarded hop can be another proxy rather than an end user.

Action: inspect a minimal cohort before any exclusion. Never block proxy networks
because a missing header left their addresses in an origin log. Check legitimate
outcomes, actual account exclusion scope, saved settings and a rollback condition.

Billing: website request evidence does not establish a new paid click, invalid
charge or credit. Investigate advertising reporting and billing separately.

https://adprotektor.app/blog/client-ip-behind-cloudflare/