ah if they are using cloudfront, they must be using the AWS managed WAF rule, which is pretty bad. I used that once and got in trouble with the client since th

ah if they are using cloudfront, they must be using the AWS managed WAF rule, which is pretty bad. I used that once and got in trouble with the client since the ruleset was over blocking.