Proxy indicators

Did the request pass through a proxy that announced itself?

What this check is

Proxies often add forwarding headers that name the chain the request travelled: the original address, the hosts it passed through. This check looks for forwarding headers beyond the ones Cloudflare itself adds when it passes a request to this site. Extras mean something between the browser and the site chose to say it was there.

What Tells reads

Forwarding headers on the request (for example X-Forwarded-For style headers), separated from Cloudflare's own

How to read your result

Warning: Extra forwarding headers are present. That is the finding; this check never fails a run on its own.
Pass: Only Cloudflare's normal forwarding headers, or none at all.

Why it matters

An announced proxy is not proof of a bot. Plenty of corporate networks and privacy tools proxy openly. But a site prices the signal in: traffic that arrives through an intermediary gets less benefit of the doubt than traffic that arrives directly, and automation that rents proxy capacity usually tries (and sometimes fails) to hide exactly this.

Where this matters most

Across the platforms Blowhorn works with, rated in the platform guide (H = matters a lot, M = contributes, L = no public evidence; tags mark vendor-stated, reported, or inferred evidence):

LinkedIn (M): proxy egress commonly draws security checkpoints [Reported]
X (H): IP reputation is a first-line anti-spam signal [Reported]
Reddit (H): its network-security block is largely an IP-reputation verdict [Reported]
GitHub (M): spam and account-creation systems correlate abusive IPs [Inference]
Hacker News (M): HN throttles and bans by IP, so shared IPs inherit others' abuse [Reported]

Everywhere else in the set this one rates Low.

In your report

Find it in the checks table on the tool page, with the detail in the Network identity section. The same findings appear in the report JSON under verdict.reasons, and the agent guide explains how to read them programmatically.