Tony Wang7 min readThe Most Common Two-CDN Combination on the Web Isn't Enterprise Redundancy
Cloudflare paired with a second CDN shows up on thousands of sites in our census, but the biggest pairing tells a different story than the other two.
Two sites both running Cloudflare and a second CDN look identical on paper. Pull the actual domains behind the three biggest such pairings in our census, and two of them look exactly like you'd expect — and the third looks like nothing you'd expect at all.
Three pairings, three very different rates
| Pairing | Sites | % of that CDN's own total |
|---|---|---|
| Cloudflare + Alibaba Cloud CDN | 7,938 | 68.4% of Alibaba Cloud CDN |
| Cloudflare + Amazon CloudFront | 5,216 | 12.2% of CloudFront |
| Cloudflare + Fastly | 3,417 | 24.4% of Fastly |
The size ordering alone is a small surprise: Alibaba Cloud CDN, not Amazon CloudFront, pairs with Cloudflare more than any other CDN in this census — and by a wide margin. The rate is the more striking number. Only 1 in 8 CloudFront sites also runs Cloudflare, and roughly 1 in 4 Fastly sites do — but more than 2 in 3 Alibaba Cloud CDN sites do. Whatever's driving that pairing, it isn't a rounding-error coincidence.
What genuine CDN hedging actually looks like
Pull real domains from the Cloudflare+CloudFront and Cloudflare+Fastly groups and they read exactly like "a company that can afford belt-and-suspenders infrastructure": perimeter81.com (rank 16,788, a cybersecurity SaaS), drchrono.com (rank 41,788, a physician EHR platform), logentries.com (rank 21,696, a logging tool), ghost.org (rank 4,058, the publishing platform), a university (westcoastuniversity.edu), a nonprofit (presbyterianmission.org). The average rank across each of these two groups sits in a similar band — 372,589 for Cloudflare+CloudFront, 410,448 for Cloudflare+Fastly — spanning from genuinely high-traffic sites down through the long tail, the shape you'd expect from "some real fraction of businesses at every size choose to run two CDNs."
The biggest pairing looks like something else entirely
The Cloudflare+Alibaba Cloud CDN group's average rank, 693,606, sits nearly twice as deep in the tail as either of the other two pairings. But rank alone could just mean "smaller sites of every kind" — the number that actually isolates a distinct archetype is CAPTCHA prevalence, checked against a proper control group.
94.1% of the Cloudflare+Alibaba group shows a CAPTCHA — a rate that dwarfs the CloudFront and Fastly pairings (22.9%, 15.4%), which are themselves already somewhat elevated over this census's overall CAPTCHA rate. The control group is what makes this conclusive rather than merely suggestive: Alibaba Cloud CDN sites that don't also run Cloudflare show a CAPTCHA just 0.93% of the time — close to a normal baseline, and roughly 100x lower than the paired group. Whatever's happening here isn't "Alibaba Cloud CDN sites like CAPTCHAs" — it's specifically the sites that pair Alibaba Cloud CDN with Cloudflare that do, at a rate that describes near-universal presence rather than an elevated tendency.
A random sample of 50 domains from the paired group reads almost nothing like the CloudFront/Fastly sample above, and nothing like a 15-domain sample of the Alibaba-alone control group either (which turns up an IoT company, a biotech news site, and other recognizable regional businesses). Instead: strings like z9x2q4k.com, pc2iyult.com, and cg4pzf.com sit alongside names like jili58f.com and mrmoney88.online — patterns that read as templated or mass-registered rather than brand names a company chose for itself. The TLD mix backs this up: alongside a .com majority (90.6%), the group's TLDs include .bet (31 domains) and .win (29) — extensions that don't show up at any meaningful rate in the CloudFront, Fastly, or Alibaba-alone groups.
We didn't stop at the domain names. A live spot-check of a handful of these sites found one that loaded cleanly: mrmoney88.online — titled "MrMoney88 | Trusted Online Free Credit Casino Malaysia." Several others in the sample returned no readable content on a live re-check, which by itself isn't conclusive (this census recorded them as reachable at scan time weeks earlier, and re-fetching a site cold afterward, especially a Cloudflare-fronted one, doesn't always succeed the same way twice) — but stacked on top of the rank gap, the isolated CAPTCHA signature, the gambling-coded TLDs, and the domain-naming pattern, the picture is a genuinely cross-validated one: this specific technical signature correlates with a specific site archetype, most plausibly a template used by Southeast Asian online-gambling operations, not a company's deliberate infrastructure-redundancy decision.
The likely mechanism, if this read is right, isn't hard to guess: Alibaba Cloud CDN as the primary asset host for a template widely used in the region, with Cloudflare layered in front for its free-tier DDoS protection, its CAPTCHA/challenge feature, and to obscure the origin server — the same reasons plenty of low-effort or adversarial site operations lean on Cloudflare's free plan generally, just paired here with a specific regional CDN choice that happens to leave a distinctive, and unusually well-isolated, fingerprint.
Limits, stated plainly
This is a cross-validated aggregate pattern, not a verified list of individual sites. Five independent signals agree here — the rank gap, the isolated ~100x CAPTCHA-rate difference against a proper control group, the gambling-coded TLD mix, the domain-naming pattern, and one live confirmation — which is considerably stronger evidence than any single check alone. But it is still not the same as having reviewed all 7,938 domains individually, and we make no claim about any specific domain not named above. Online gambling is a legal, regulated industry in many jurisdictions; the point of this piece is an infrastructure-fingerprinting curiosity (two unrelated technical signals turning out to correlate with a site archetype), not a judgment about the legality or legitimacy of any site's business. And as with the rest of this census, technology detection reflects what a plain request to a homepage reveals — it can't confirm what's actually being served behind that homepage.
Query the full Tech Stack dataset
1,000,000 fingerprinted domains — CDN, CMS, ecommerce, analytics, web server and more — over one REST API, ranked by Tranco traffic rank.
Frequently asked questions
What is the most common two-CDN combination on the web?
Cloudflare paired with Alibaba Cloud CDN, by a wide margin - 7,938 sites in Crawlora's 1,000,000-domain tech-stack census, ahead of Cloudflare+Amazon CloudFront (5,216) and Cloudflare+Fastly (3,417). 68.4% of every site running Alibaba Cloud CDN also runs Cloudflare, vs. just 12.2% of CloudFront sites and 24.4% of Fastly sites.
Does running two CDNs mean a site is enterprise-grade infrastructure?
It depends entirely on which two CDNs. The Cloudflare+CloudFront and Cloudflare+Fastly pairings read like genuine enterprise redundancy - real, diverse companies at an average Tranco rank of 372,589 and 410,448 respectively, with CAPTCHA rates of 22.9% and 15.4%. The Cloudflare+Alibaba Cloud CDN pairing looks completely different: average rank 693,606 (nearly double), and a CAPTCHA rate of 94.1%.
Why does the Cloudflare+Alibaba Cloud CDN pairing show a 94.1% CAPTCHA rate?
A controlled comparison isolates this to the pairing itself: Alibaba Cloud CDN sites that do NOT also run Cloudflare show a CAPTCHA just 0.93% of the time - a roughly 100x lower rate. Combined with a domain-naming pattern that reads as templated/mass-registered, a TLD mix that includes .bet and .win, and a live spot-check that confirmed a real online casino site, the pairing correlates with a specific site archetype rather than a deliberate infrastructure decision.
Is Alibaba Cloud CDN itself associated with gambling sites?
No - that's specifically why the control group matters. Alibaba Cloud CDN sites that don't also run Cloudflare look like ordinary regional businesses (an IoT company, a biotech news site) with a CAPTCHA rate of just 0.93%, in line with a normal baseline. It's the Cloudflare+Alibaba Cloud CDN pairing specifically, not Alibaba Cloud CDN generally, that carries the signature.