origin-ip-discovery

Origin IP Discovery

Discover the real server IP behind CDN/WAF protections (Cloudflare, Akamai, Fastly). When the origin IP is found, the raw server is exposed without firewall rules, rate limiting, or application-layer filtering. Techniques include favicon hash fingerprinting across Shodan, historical DNS records from passive sources, SSL certificate SAN field matching, and Google Analytics ID cross-referencing.

When to Use

• Target is behind Cloudflare/Akamai and returns 403 or CAPTCHA challenges on all requests.
• You need direct access to the origin to bypass WAF rules.
• Subdomain enumeration reveals internal/staging hosts on non-CDN IPs.
• The target uses a single favicon across all infrastructure.
• SSL certificates share the same organization name across IPs.

Prerequisites

• terminal with curl, python3, and shodan CLI.
• Shodan API key: shodan init <KEY>.
• Target favicon file or URL.

Quick Detection

# Check Cloudflare presence
curl --max-time 30 --connect-timeout 10 -sI "https://target.com" | grep -i "cf-ray\|server: cloudflare"

# If Cloudflare detected, check for common origin leaks
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/cdn-cgi/trace" | grep -E "ip=|colo="

Procedure

Phase 1 — Favicon Hash Fingerprinting

# Get favicon hash
FAVICON_URL="https://target.com/favicon.ico"
curl --max-time 30 --connect-timeout 10 -sk "$FAVICON_URL" -o favicon_target.ico

# Calculate hash
python3 -c "
import hashlib, base64
with open('favicon_target.ico', 'rb') as f:
    hash_bytes = base64.b64encode(hashlib.md5(f.read()).digest())
    print(f'favicon hash: {hash_bytes.decode()}')
"

# Search Shodan for IPs serving this favicon
HASH=$(python3 -c "
import hashlib, base64
with open('favicon_target.ico','rb') as f:
    print(base64.b64encode(hashlib.md5(f.read()).digest()).decode())
")
shodan search "http.favicon.hash:$HASH" --fields ip_str,port,org,hostnames

# Automatedtools
python3 favUp.py -ff favicon_target.ico --shodan-cli
python3 favUp.py --web target.com -sc