Cloudflare origin IP discovery tool — 2026 Enhanced Edition

CloudFail discovers the real origin IP address(es) behind a Cloudflare-protected domain by querying certificate transparency logs, passive DNS databases, and optional paid APIs. It never sends traffic directly to the target during passive mode.

┌─────────────────────────────────────────────────────────────────────┐
│                          CloudFail v2.0                             │
├─────────────────────────────────────────────────────────────────────┤
│  CLI (__main__.py)                                                  │
│    │                                                                │
│    ├─ Phase 1: Target Init        cloudflare.py                     │
│    │     Resolve domain → check CF membership                      │
│    │     Load/update CF CIDR ranges (JSON API + plain-text fallback)│
│    │                                                                │
│    ├─ Phase 2: Passive Recon      certificate_pivot.py              │
│    │     ┌──────────────────────────────────────────────────┐      │
│    │     │  Free (no API key)         Paid (API key)        │      │
│    │     │  ─────────────────         ───────────────────── │      │
│    │     │  CertSpotter               Censys Platform v3    │      │
│    │     │  crt.sh (retry+backoff)    Shodan                │      │
│    │     │  AnubisDB                  SecurityTrails        │      │
│    │     │  RapidDNS                                        │      │
│    │     │  ThreatMiner                                     │      │
│    │     │  URLScan.io                                      │      │
│    │     │  Wayback Machine CDX                             │      │
│    │     └──────────────────────────────────────────────────┘      │
│    │     + Passive DNS: HackerTarget, AlienVault OTX,              │
│    │                    ViewDNS.info, RapidDNS passive              │
│    │                                                                │
│    ├─ Phase 3: Subdomain Resolution   dns_history.py               │
│    │     CT names + wordlist → dnspython bulk resolve (threads)    │
│    │     Wildcard detection                                         │
│    │                                                                │
│    └─ Phase 4: IP Enrichment          asn_filter.py                │
│          ASN lookup → CF/non-CF classification → confidence score  │
│                                                                     │
│  utils/http_client.py  (ALL HTTP goes through here)                │
│    requests.Session + Retry(total=5, backoff_factor=1)             │
│    Optional Tor SOCKS5 proxy                                        │
└─────────────────────────────────────────────────────────────────────┘

# Python 3.10–3.12 required
python -m venv venv
source venv/bin/activate          # Windows: venv\Scripts\activate

pip install -r requirements.txt

# macOS
brew install tor && brew services start tor

# Debian/Ubuntu
sudo apt install tor && sudo service tor start

# Verify Tor is listening on port 9050
nc -zv 127.0.0.1 9050

python -m cloudfail -t example.com --confirm-scope

python -m cloudfail -t example.com \
  --censys-api-token YOUR_TOKEN \
  --shodan-api YOUR_KEY \
  --securitytrails-api YOUR_KEY \
  --confirm-scope

python -m cloudfail -t example.com --passive-only --confirm-scope

python -m cloudfail -t example.com \
  --output json --output-file results.json --confirm-scope

python -m cloudfail -t example.com --tor --confirm-scope

python -m cloudfail -t example.com --no-verify-ssl --confirm-scope

python -m cloudfail -t example.com --debug --confirm-scope

python -m cloudfail -t example.com --quiet --output json --confirm-scope

{
  "target": "example.com",
  "resolved_ip": "104.21.5.12",
  "behind_cloudflare": true,
  "ct_names": [
    "mail.example.com",
    "api.example.com",
    "staging.example.com"
  ],
  "passive_dns_ips": ["203.0.113.42", "198.51.100.7"],
  "non_cloudflare_ips": [
    {
      "ip": "203.0.113.42",
      "asn": "AS12345",
      "is_cloudflare": "no",
      "confidence": "90"
    }
  ],
  "subdomain_hits": [
    { "host": "staging.example.com", "ip": "203.0.113.42", "behind_cloudflare": false },
    { "host": "www.example.com",     "ip": "104.21.5.12",  "behind_cloudflare": true  }
  ]
}

CloudFail is designed to never crash because a single data source fails:

When --tor is specified:

1. The shared requests.Session is reconfigured to use socks5h://127.0.0.1:9050
2. Connectivity is verified via https://check.torproject.org/api/ip
3. All subsequent HTTP calls (including DNS-over-HTTPS style) route through Tor
4. Requires: pip install PySocks and a running Tor service

Note: DNS resolution via dnspython uses system resolvers, not the HTTP proxy. For fully anonymous DNS, run a local DNS-over-Tor setup or use --passive-only with Tor.

# Force fresh download and disable SSL verification
python -m cloudfail -t example.com --update-ranges --no-verify-ssl --confirm-scope

crt.sh can be slow under load. CloudFail retries automatically (5 attempts, exponential backoff). Other sources (CertSpotter, AnubisDB, RapidDNS etc.) will still return data.

OTX rate limits anonymous access. CloudFail backs off and skips OTX after 3 failures. Other passive DNS sources continue. Consider registering for a free OTX API key.

Updated for 2026: Censys now uses the Platform API v3 with Personal Access Tokens (Bearer tokens). Generate your token at https://accounts.censys.io/settings/personal-access-tokens. Note: Free users can only use lookup endpoints, not search — you need a Starter or Enterprise plan to search hosts.

• Try --debug to see full HTTP responses
• Try --no-verify-ssl if behind a corporate proxy
• Check your internet connection can reach external APIs

HackerTarget limits anonymous requests to 100/day. The ASN enrichment phase uses one HackerTarget call per non-CF IP. For large scans register for a free API key at hackertarget.com.

• Phase 2 passive sources run concurrently (5 threads by default)
• Phase 3 subdomain resolution runs with --threads workers (default: 10)
• Typical full scan of a large domain: 3–8 minutes
• Use --passive-only to skip the ~11k subdomain wordlist and reduce to 1–2 minutes
• Use --threads 25 to speed up subdomain resolution (watch for DNS resolver bans)

• Censys v2 free tier: limited monthly query quota — check search.censys.io/account
• Shodan free tier: host search is a paid feature; you need a paid plan or use the membership API
• SecurityTrails free tier: 50 API calls/month on free plan
• HackerTarget: 100 free queries/day across all their endpoints combined

CloudFail-main/
├── requirements.txt
├── README.md
└── cloudfail/
    ├── __init__.py
    ├── __main__.py          # CLI entry point, phase orchestration
    ├── config.py            # Constants, runtime state
    ├── data/
    │   ├── subdomains.txt   # Built-in ~11k subdomain wordlist
    │   └── cf-subnet.txt    # Cached Cloudflare CIDR ranges (auto-generated)
    ├── core/
    │   ├── cloudflare.py    # CF range management, IP detection
    │   ├── certificate_pivot.py  # CT + passive sources + Censys/Shodan/ST
    │   ├── dns_history.py   # DNS resolution + passive DNS aggregation
    │   ├── asn_filter.py    # ASN lookup, IP enrichment
    │   └── tor_handler.py   # Tor SOCKS5 proxy configuration
    └── utils/
        ├── http_client.py   # Centralised HTTP session (ALL requests here)
        └── logger.py        # Rich-based logger with debug/quiet modes

This tool is provided for authorized security testing and research purposes only.

• You must have explicit written permission from the asset owner before scanning
• Unauthorized scanning may violate the Computer Fraud and Abuse Act (CFAA), the Computer Misuse Act, and equivalent laws in your jurisdiction
• The authors accept no liability for misuse of this tool
• Cloudflare's ToS prohibits intentional origin IP discovery against protected customers
• Use responsibly and ethically

1. Fork the repository
2. Create a feature branch: git checkout -b feature/new-source
3. Add your data source in certificate_pivot.py or dns_history.py
4. Ensure it:
   • Uses http_client.get() — never requests.get() directly
   • Has timeout handling
   • Returns an empty list/set on any failure (never raises)
   • Has a logger.info/warning for rate limits
   • Has a logger.debug_exc() call in the except block
5. Add it to the concurrent source map in the aggregation function
6. Update the data sources table in README.md
7. Submit a PR

MIT License — see original CloudFail repository for full text.

Original CloudFail by m0rtem (2018).
v2.0 Enhanced Edition (2026).