Cloudflare has the advantage of offering the largest DDoS protection services in the world. This means that it is worthwhile for them to note down the sources of botnet traffic. Typically, an individual zombie device in a botnet is rarely reused for attacks on the same target, so a botnet protection system would be wasting time and space maintaining a reference database of IP addresses to block. A list of infected IP addresses can extend to millions of entries that would take too long to scan through, so rather than listing IP addresses, Cloudflare uses a system of fingerprinting. This implements selective challenges to filter out potential threats while allowing through the majority of traffic.