Abdallah Alsalmi retweetledi
Most investigators stop their research when they see a Cloudflare IP
That’s a mistake!
Cloudflare hides the origin server’s real IP address but it doesn’t always make it impossible to find.
With the right techniques, you can often uncover the actual hosting infrastructure behind a protected website.
Here are 3 methods I regularly use:
🧠 Criminal IP Search Engine:
One of the fastest ways to investigate infrastructure behind a domain.
🔎 Reverse Favicon Search: Some websites reuse the same favicon across multiple services or subdomains. Searching by favicon hash can reveal infrastructure that isn’t behind Cloudflare.
📜 WHOIS History: Older WHOIS records sometimes expose previous hosting providers or IP addresses used before Cloudflare protection was enabled.
Using Criminal IP, you can pivot from a domain and uncover:
✅Possible origin server IPs
✅Passive DNS history
✅ Abuse records
✅Malware associations
✅Scanner activity
✅Related infrastructure
Example:
I searched a Cloudflare-protected domain inside Criminal IP and it immediately revealed the underlying server IP where the website was actually hosted.
Most people never go this far but this step often unlocks the biggest findings in a website investigation.
Try out the search engine: shorturl.at/yHwuJ
English
