Millions of websites use Cloudflare as a reverse proxy. When you visit a Cloudflare-protected site, you connect to Cloudflare's servers — not the origin server. This hides the real server IP from attackers and the public. But the real IP sometimes leaks through various channels.
How Cloudflare Protection Works
Cloudflare sits between visitors and the origin server. All traffic goes through Cloudflare's network, which provides DDoS protection, CDN caching, and IP masking. The DNS records for the domain point to Cloudflare's anycast IPs, not the real server.
Why the Real IP Sometimes Leaks
- Historical DNS records — If the domain was publicly accessible before enabling Cloudflare, the original IP may appear in historical DNS databases.
- Subdomain exposure — Subdomains like mail.domain.com or ftp.domain.com often bypass Cloudflare and expose the real IP directly.
- SSL certificate records — Certificate Transparency logs may reveal origin IPs from before Cloudflare was enabled.
- Email headers — Email sent from the site's server contains the real IP in its headers.
Why This Is Harder Than a Normal Reverse Proxy
Cloudflare uses anycast routing, meaning the same IP address is announced from dozens of data centers worldwide simultaneously, and your connection reaches whichever one is network-closest to you — there's no single "Cloudflare server" to trace back to, unlike a typical reverse proxy setup with one fixed IP. This is part of why traditional IP-tracing techniques that work against simpler proxies often fail outright against Cloudflare: you're not looking for one hidden server, you're trying to find the origin behind a globally distributed network.
Actually Using Certificate Transparency Logs
Every publicly trusted SSL certificate gets logged in a public, searchable Certificate Transparency database (crt.sh is a commonly used interface for it) the moment it's issued. Searching a domain there often surfaces certificates issued before Cloudflare was enabled, or certificates for subdomains that were never meant to be public — and since some of those certificates include the actual origin server's hostname or a direct-connect subdomain in their Subject Alternative Names field, this can reveal infrastructure details that DNS history alone wouldn't show.
How to Look Up the Real IP
Use Anonymiz Cloudflare Resolver — enter any domain to attempt to resolve the real origin IP using multiple detection methods. Free, no account needed.
How to Properly Secure Your Origin
Configure your origin server to only accept connections from Cloudflare's IP ranges. Block all other inbound connections on ports 80 and 443. This prevents direct attacks even if your origin IP is discovered.
