origin-ip-discovery

1# Origin IP Discovery
2 
3Discover the real server IP behind CDN/WAF protections (Cloudflare, Akamai, Fastly). When the origin IP is found, the raw server is exposed without firewall rules, rate limiting, or application-layer filtering. Techniques include favicon hash fingerprinting across Shodan, historical DNS records from passive sources, SSL certificate SAN field matching, and Google Analytics ID cross-referencing.
4 
5## When to Use
6 
7- Target is behind Cloudflare/Akamai and returns 403 or CAPTCHA challenges on all requests.
8- You need direct access to the origin to bypass WAF rules.
9- Subdomain enumeration reveals internal/staging hosts on non-CDN IPs.
10- The target uses a single favicon across all infrastructure.
11- SSL certificates share the same organization name across IPs.
12 
13## Prerequisites
14 
15- `terminal` with curl, python3, and shodan CLI.
16- Shodan API key: `shodan init <KEY>`.
17- Target favicon file or URL.
18 
19## How to Run
20 
21```bash
22# Check Cloudflare presence
23curl --max-time 30 --connect-timeout 10 -sI "https://target.com" | grep -i "cf-ray\|server: cloudflare"
24 
25# If Cloudflare detected, check for common origin leaks
26curl --max-time 30 --connect-timeout 10 -sk "https://target.com/cdn-cgi/trace" | grep -E "ip=|colo="
27```
28 
29## Quick Detection
30 
31```bash
32# Check Cloudflare presence
33curl --max-time 30 --connect-timeout 10 -sI "https://target.com" | grep -i "cf-ray\|server: cloudflare"
34 
35# If Cloudflare detected, check for common origin leaks
36…