# m0rtem/CloudFail

Utilize misconfigured DNS and old database records to find hidden IP's behind the CloudFlare network

Repository: https://github.com/m0rtem/CloudFail
Canonical: https://ross.abutalabs.com/products/cloudfail
Language: Python
License: MIT
License Family: permissive
Topics: cloudflare, tor, ip, database, python3, scanner, recon, bruteforce, cloudflare-ip, pentest, pentesting
Last push: 2024-03-26T19:44:29+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3751, "days_push": 890, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2683, forks 517 (observed 2026-08-28T04:07:10.116558+00:00)

## What it is
CloudFail is a Python 3 command-line reconnaissance tool that attempts to discover the real IP address of servers hidden behind Cloudflare. It combines misconfigured DNS scanning via DNSDumpster, Crimeflare database lookups, and bruteforcing over 2500 subdomains, optionally routing all requests through Tor.

## Use cases
- find the real IP behind a Cloudflare-protected site
- scan a target for misconfigured DNS records
- bruteforce subdomains of a domain during a pentest
- check the Crimeflare database for a domain's historical IPs
- run anonymous reconnaissance through Tor
- gather OSINT on a website's origin server

## When to choose
- you are doing authorized penetration testing or security research on Cloudflare-protected targets
- you want a lightweight Python CLI with multiple recon phases in one tool
- you need Tor support to anonymize your scanning traffic

## When to avoid
- you have not obtained authorization from the target's network owner
- the target is properly configured and leaks no origin IP - the tool is a PoC with no guaranteed results
- you need a maintained, actively developed scanner - development is minimal
- you need a GUI or Windows-native tooling without extra setup

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: osint, penetration-testing, networking, web-scraping
- domain: security, penetration-testing, osint, networking
- platform: windows, cli, python
- tags: cloudflare, reconnaissance, dns-recon, tor, subdomain-bruteforce, pentesting, linux, macos

## Member repositories
- m0rtem/CloudFail (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:10.116558+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:17:53.243837+00:00, confidence not recorded.
  - readme: https://github.com/m0rtem/CloudFail (fetched 2026-08-28T04:07:10.116558+00:00, sha d176749f2273)
- Data as of 2026-08-30T08:39:29.467469+00:00.