| Cloudflare frontage confirmation | Users who only need to confirm why Cloudflare appears first | DNS, HTTP/TLS, Anycast, and edge-platform behavior | It only explains the frontage layer and does not mean the true origin is already known | Low | Best as the first layer |
| Origin-clue cross-check | Users who need to continue toward the real origin | DNS chains, subdomains, mail records, historical data, and platform traces | The workflow is slower and often ends in conditional rather than absolute conclusions | Medium | Best as the main judgment layer |
| Final responsibility boundary | Users who ultimately need to know who is responsible | The layer relationship between the raw provider, upper hosting brand, Cloudflare, and the seller | Public evidence may still be insufficient, so high-confidence outputs must stay acceptable | Medium | Best as the final layer |