How to Find the Origin IP Behind Cloudflare

Cloudflare's proxy (the orange cloud) masks your origin server's IP address by routing traffic through Cloudflare's edge network. But the protection only works if your origin IP is never disclosed through any other channel. In practice, origin IPs leak through a predictable set of mistakes — and once found, an attacker can bypass Cloudflare entirely by connecting directly to your server.

Why bypassing Cloudflare matters

Cloudflare's proxy provides DDoS mitigation, WAF rules, bot management, and rate limiting. All of these protections disappear the moment an attacker connects directly to your origin IP. An attacker who knows your origin IP can:

• Flood your origin server with a DDoS attack that bypasses Cloudflare's scrubbing
• Send malicious payloads directly to your application, bypassing WAF rules
• Connect to services running on your server that were never intended to be public (databases, admin interfaces, internal APIs)
• Exploit origin-server vulnerabilities that Cloudflare's edge would normally block or rate-limit

Method 1: Historical DNS records

The most reliable source is DNS history. Before a site moved to Cloudflare, it had a DNS A record pointing directly to the origin server. DNS history services archive these records:

• SecurityTrails — free tier provides historical DNS lookups
• ViewDNS IP History — free, shows historical A records
• Shodan — SSL certificate searches can correlate hostname to IP

Search for the domain in question. If the A record before the Cloudflare migration pointed to 198.51.100.42, verify with:

curl -sk --resolve yourdomain.com:443:198.51.100.42 https://yourdomain.com/ \
  -o /dev/null -w "%{http_code}"

A 200 or 302 response from the origin IP confirms it's still active.

Method 2: Subdomains not proxied through Cloudflare

The most common leak source. Many organizations proxy www and the apex domain through Cloudflare but leave other subdomains as DNS-only (grey cloud). Common examples:

• mail.yourdomain.com — MX records and mail server A records must point to the actual mail server IP
• ftp.yourdomain.com — FTP servers can't run behind Cloudflare's proxy
• direct.yourdomain.com, origin.yourdomain.com — sometimes configured for internal use or as a bypass for monitoring
• cpanel.yourdomain.com, whm.yourdomain.com — cPanel/WHM interfaces are incompatible with Cloudflare proxy
• vpn.yourdomain.com, rdp.yourdomain.com — network access services
• Any subdomain used for a non-HTTP service

If these subdomains are on the same server as your web application, they reveal the origin IP. Enumerate subdomains using passive DNS:

# Using subfinder (passive subdomain enumeration)
subfinder -d yourdomain.com -silent

# Check each for Cloudflare proxy vs. direct IP
for sub in $(subfinder -d yourdomain.com -silent); do
  ip=$(dig +short A $sub | head -1)
  # Cloudflare IP ranges: 103.21.244.0/22, 103.22.200.0/22, etc.
  echo "$sub -> $ip"
done

Method 3: SSL/TLS certificate transparency logs

Certificate Transparency (CT) logs record every TLS certificate issued. An origin server that requests its own certificate (even if it sits behind Cloudflare) will appear in CT logs. Search crt.sh:

curl -s "https://crt.sh/?q=%.yourdomain.com&output=json" \
  | jq '.[].name_value' | sort -u

This reveals all subdomains with issued certificates. Any subdomain not proxied through Cloudflare is a potential IP leak.

Method 4: SPF records and email headers

SPF records list authorized mail senders. They frequently include the origin server's IP directly:

dig TXT yourdomain.com | grep spf

A record like v=spf1 ip4:198.51.100.42 include:sendgrid.net ~all directly discloses 198.51.100.42. Similarly, email headers from newsletters or transactional email sent by the origin server will contain Received: from headers showing the sending IP.

Method 5: Shodan and Censys reverse search

Shodan indexes HTTP banners and TLS certificates from direct IP scans of the entire IPv4 space. If your origin server's TLS certificate contains your domain name (which it almost certainly does), Shodan has indexed it:

# Shodan CLI
shodan search "ssl.cert.subject.cn:yourdomain.com" --fields ip_str,port

# Censys (web)
# Search: parsed.names: yourdomain.com

This approach finds the origin regardless of Cloudflare because Shodan scanned the IP directly and saw the certificate that mentions your domain.

Method 6: The website's own content

Sites sometimes leak their own origin IP through:

• Absolute URLs in HTML/CSS/JS that reference an IP address directly
• Server-sent error pages that include internal IP addresses
• API responses that include X-Forwarded-For, X-Real-IP, or custom headers that echo the origin
• WebSocket connections (wss://) that bypass Cloudflare if pointed directly at the origin
• PDF or image metadata embedded at upload time

Verifying a suspected origin IP

Once you have a candidate IP, verify it hosts your site by sending an HTTP request with the correct Host header:

curl -sk --resolve yourdomain.com:443:CANDIDATE_IP \
  https://yourdomain.com/robots.txt | head -5

# Or with an explicit Host header (HTTP/1.1)
curl -sk -H "Host: yourdomain.com" \
  https://CANDIDATE_IP/robots.txt

If the response matches your site's content, the origin is confirmed. Check if the IP is in Cloudflare's published IP ranges to confirm it's NOT Cloudflare:

# Cloudflare publishes its ranges
curl -s https://www.cloudflare.com/ips-v4

# Quick check for a specific IP
whois CANDIDATE_IP | grep -i 'org\|netname\|descr'

Remediation

• Enable Cloudflare's firewall rule to block non-Cloudflare traffic at the origin: configure your origin's firewall to only accept connections from Cloudflare's IP ranges
• Proxy ALL subdomains or move non-proxiable services (mail, FTP) to separate IP addresses not associated with your web origin
• Change the origin IP if it has been widely disclosed — get a new server or elastic IP, then lock down the firewall before DNS changes propagate
• Remove SPF ip4: entries pointing to your web origin; use include: for mail service providers instead
• Use Cloudflare's Authenticated Origin Pulls to ensure only Cloudflare can initiate connections to your origin

Orb44's Cloudflare origin check tests whether your origin IP is discoverable through DNS history, unproxied subdomains, and certificate transparency logs — giving you a single report of where your origin is exposed before attackers find it.

FAQ: Does changing my server's IP address permanently fix this?

Only if you also prevent the new IP from leaking through the same channels. A new IP will appear in CT logs as soon as you provision a new TLS certificate, will show up in SPF records if you copy the old SPF policy, and will be indexed by Shodan within days of going live. The fix is controlling which channels can disclose the IP, not just rotating it.

FAQ: Can Cloudflare Tunnels solve this?

Yes. Cloudflare Tunnel (cloudflared) creates an outbound-only connection from your origin to Cloudflare, eliminating the need for any public inbound port. There's no IP to discover because the origin never listens on a public interface. This is the strongest architecture for hiding the origin — at the cost of all traffic routing through Cloudflare, which may not be acceptable for high-volume or latency-sensitive workloads.

FAQ: Is this a vulnerability I need to report?

Origin IP disclosure is typically classified as an "information exposure" finding in penetration tests. It's not exploitable by itself, but it's a precondition for bypassing DDoS protection and WAF rules. Many bug bounty programs accept it as a low to medium finding depending on what the origin server exposes when contacted directly.