diff --git a/waf/edgecast.py b/waf/edgecast.py
index 1555a05da..0f37f5f3e 100644
--- a/waf/edgecast.py
+++ b/waf/edgecast.py
@@ -17,7 +17,7 @@ def detect(get_page):
 
     for vector in WAF_ATTACK_VECTORS:
         page, headers, code = get_page(get=vector)
-        retval = re.search(r"\AECS", headers.get(HTTP_HEADER.SERVER, ""), re.I) is not None
+        retVal = code == 400 and re.search(r"\AECDF", headers.get(HTTP_HEADER.SERVER, ""), re.I) is not None
         if retval:
             break