Binance Futures 418/-1003 bans naming a CloudFront IP that isn’t mine — does the limiter use XFF or the CDN IP?

Operating a bot towards Binance USDⓈ-M Futures and getting recurring 418/-1003 IP bans — however the IP within the error physique isn’t my server’s, and my used-weight is ~zero when it hits.

What I’ve discovered:
• <fapi.binance.com> is a Binance-owned CloudFront distribution.
• The banned IP is in an AWS range tagged CLOUDFRONT_ORIGIN_FACING — i.e. it’s on the hidden edge→origin hop, not my egress and never the edge I hook up with.
• x-mbx-used-weight-1m is usually zero at ban time, and the error physique says “Please use the websocket… to keep away from bans.”

The confusing part: API-key IP whitelisting works for me, so Binance’s auth layer clearly reads my real shopper IP from X-Forwarded-For — but the rate-limiter appears to key on the CloudFront IP, collateral-banning everyone behind that edge.

Questions:
1. Is REST REQUEST_WEIGHT enforced on the actual shopper IP (XFF) or the CloudFront origin-facing IP? Any method to check definitively?
2. If it’s the CDN IP — has altering your VPS/egress IP ever truly helped?
three. Any client-side knob (header, payload, endpoint variant) for per-key/per-real-IP attribution, or is it simply “go WebSocket-first” / Dealer program?
four. For many who scaled previous this: did the Binance Broker (Hyperlink) program offer you a separate rate-limit envelope that solved it?

Thanks!