{"id":1362,"date":"2018-06-18T18:18:01","date_gmt":"2018-06-18T18:18:01","guid":{"rendered":"https:\/\/miloserdov.org\/?p=1362"},"modified":"2018-06-20T19:26:53","modified_gmt":"2018-06-20T19:26:53","slug":"how-to-find-out-if-a-site-is-behind-the-cloudflare-or-not","status":"publish","type":"post","link":"https:\/\/miloserdov.org\/?p=1362","title":{"rendered":"How to find out if a site is behind CloudFlare or not"},"content":{"rendered":"<div class=\"0b20205ac99e89c6cabdb919fd9d1a8a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-client=\"ca-pub-7219829351026140\"\r\n     data-ad-slot=\"9942251718\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\r\n\r\n\n<\/div>\n<p style=\"text-align: justify;\">\n\tHow to utilize misconfigured DNS and old database records to find hidden IP&#39;s behind the CloudFlare network, said in articles:\n<\/p>\n<ul>\n<li style=\"text-align: justify;\">\n\t\t<a href=\"https:\/\/miloserdov.org\/?p=1375\" target=\"_blank\">How to find out the real IP of a site in Cloudflare<\/a>\n\t<\/li>\n<li>\n\t\tDatabase of hidden site&#39;s IP behind CloudFlare. Searching for sites belong to the same CloudFlare account\n\t<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">\n\tIn this note, we will learn how to check whether a site is using CloudFlare or not?\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tDoes a site use name servers of CloudFlare<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tOne of the signs that the site stays behind CloudFlare is usage of the CloudFlare name servers, which look like&nbsp;<strong>*.ns.cloudflare.com<\/strong>\n<\/p>\n<p style=\"text-align: justify;\">\n\tName Servers of a site can be viewed with the <strong>dig <\/strong>command, running it as follows:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndig DOMAIN NS +short<\/pre>\n<p style=\"text-align: justify;\">\n\tWhere the word <strong>DOMAIN <\/strong>should be replaced with a domain name, for example:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndig anti-malware.ru NS +short\r\nangela.ns.cloudflare.com.\r\nchip.ns.cloudflare.com.<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/06\/31.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1365\" height=\"77\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/06\/31.png\" width=\"448\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tAlternatively, you can use <strong>whois <\/strong>command with filtering out the excess information:\n<\/p>\n<pre class=\"brush:bash;\">\r\nwhois DOMAIN | grep -E &#39;^nserver|^Name Server&#39;<\/pre>\n<p style=\"text-align: justify;\">\n\tExample:\n<\/p>\n<pre class=\"brush:bash;\">\r\nwhois searchengines.guru | grep -E &#39;^nserver|^Name Server&#39;\r\nName Server: ray.ns.cloudflare.com\r\nName Server: dora.ns.cloudflare.com<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/06\/32.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1366\" height=\"75\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/06\/32.png\" width=\"744\" \/><\/a>\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tDoes a site use the CloudFlare IP?<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tThe second, even more reliable way to find out whether a site is protected with CloudFlare is to check if the IP of the site of interest belongs to this organization.\n<\/p>\n<p style=\"text-align: justify;\">\n\tIP of a site can be found as follows:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndig DOMAIN +short<\/pre>\n<p style=\"text-align: justify;\">\n\tExample:\n<\/p>\n<pre class=\"brush:bash;\">\r\ndig searchengines.guru +short\r\n104.20.122.18\r\n104.20.123.18<\/pre>\n<p style=\"text-align: justify;\">\n\tOne or more IP addresses can be displayed, use anyone for analysis.\n<\/p>\n<p style=\"text-align: justify;\">\n\tCheck the received IP with the <strong>whois <\/strong>command like that:\n<\/p>\n<pre class=\"brush:bash;\">\r\nwhois IP_address<\/pre>\n<p style=\"text-align: justify;\">\n\tExample:\n<\/p>\n<pre class=\"brush:bash;\">\r\nwhois 104.20.122.18<\/pre>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/06\/33.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1367\" height=\"1040\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/06\/33.png\" width=\"965\" srcset=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/06\/33.png 965w, https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/06\/33-768x828.png 768w\" sizes=\"(max-width: 965px) 100vw, 965px\" \/><\/a>\n<\/p>\n<p style=\"text-align: justify;\">\n\tIf a &lsquo;<strong>Cloudflare, Inc.<\/strong>&rsquo; string is present in the information received, then the target site uses the CloudFlare IP and, therefore, is protected by this network.\n<\/p>\n<h2 style=\"text-align: justify;\">\n\tOnline service to check if a site is using CloudFlare<br \/>\n<\/h2>\n<p style=\"text-align: justify;\">\n\tThe described methods are automated in the <a href=\"https:\/\/suip.biz\/?act=iscloudflare\" target=\"_blank\">online service<\/a>, you just enter a domain name of a site and it will check its NS records and its IP for belonging to Cloudflare.\n<\/p>\n<p style=\"text-align: justify;\">\n\tInstead of whois, the GeoLite2-ASN database is used, but it does not change the essence.\n<\/p>\n<p style=\"text-align: justify;\">\n\tOutput example of the service:\n<\/p>\n<p style=\"text-align: justify;\">\n\t<a href=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/06\/35.png\"><img loading=\"lazy\" decoding=\"async\" alt=\"\" class=\"alignnone size-full wp-image-1371\" height=\"156\" src=\"https:\/\/miloserdov.org\/wp-content\/uploads\/2018\/06\/35.png\" width=\"342\" \/><\/a><\/p>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>How to utilize misconfigured DNS and old database records to find hidden IP&#39;s behind the CloudFlare network, said in articles: How to find out the real IP of a site in Cloudflare Database of hidden site&#39;s IP behind CloudFlare. Searching for sites belong to the same CloudFlare account In this<a href=\"https:\/\/miloserdov.org\/?p=1362\" class=\"read-more\">Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":1371,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[134,135,52,13,51,136],"class_list":["post-1362","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-information-gathering","tag-cloudflare","tag-dig","tag-infogathering","tag-ip","tag-web-sites","tag-whois"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/1362"}],"collection":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1362"}],"version-history":[{"count":7,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/1362\/revisions"}],"predecessor-version":[{"id":1372,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/posts\/1362\/revisions\/1372"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=\/wp\/v2\/media\/1371"}],"wp:attachment":[{"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1362"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1362"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/miloserdov.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1362"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}