Abuse detection misses distributed attacks

An application sometimes receives traffic through the CDN and sometimes directly, but logging logic always trusts the forwarded IP header.