We present the first global study of connection tampering through a passive analysis of traffic received at a global CDN, Cloudflare. Our study shows that passive measurement can be a powerful complement to active measurement in understanding connection tampering and improving transparency.