# christophetd/CloudFlair

🔎 Find origin servers of websites behind CloudFlare by using Internet-wide scan data from Censys.

Repository: https://github.com/christophetd/CloudFlair
Canonical: https://ross.abutalabs.com/products/cloudflair
Homepage: https://blog.christophetd.fr/bypassing-cloudflare-using-internet-wide-scan-data/
Language: Python
License Family: other
Topics: cloudflare, pentest-tool, pentest, censys
Last push: 2025-05-01T10:06:43+00:00

## Health v2 (maintenance only)
Score: 41/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 19, release rhythm 35, longevity 100
- inputs: {"age_days": 3155, "days_push": 489, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2972, forks 383 (observed 2026-08-28T04:07:32.803740+00:00)

## What it is
CloudFlair is a Python CLI tool that finds the origin servers of websites protected by Cloudflare or CloudFront by searching Censys internet-wide scan data for exposed hosts presenting SSL certificates matching the target domain. It automates detection of a common CDN misconfiguration where origin servers don't restrict access to CDN IP ranges.

## Use cases
- find origin server behind cloudflare
- bypass cloudflare protection for a website
- identify misconfigured CDN origin servers
- pentest recon on cloudflare-protected sites
- check if my origin server is exposed
- find real IP of a website using censys

## When to choose
- you're doing authorized penetration testing or bug bounty recon on a Cloudflare-protected site
- you want to audit whether your own origin servers are publicly reachable
- you have a paid Censys API account and want automated origin discovery

## When to avoid
- you only have a free Censys account, since API access is no longer available for free tiers
- you need a general-purpose vulnerability scanner rather than a single-purpose origin discovery tool
- you're looking for a Cloudflare bypass that works without internet-wide scan data

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: osint, penetration-testing, security, networking
- domain: security, penetration-testing, osint, networking
- platform: python, cli, windows
- tags: cloudflare-bypass, origin-server-discovery, censys, cdn-misconfiguration, recon, linux, macos

## Member repositories
- christophetd/CloudFlair (main) score 41

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:32.803740+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:31:37.968677+00:00, confidence not recorded.
  - readme: https://github.com/christophetd/CloudFlair (fetched 2026-08-28T04:07:32.803740+00:00, sha ba77ac230205)
  - homepage: https://blog.christophetd.fr/bypassing-cloudflare-using-internet-wide-scan-data/ (fetched 2026-08-29T09:47:04.064899+00:00, sha a78a81e8e8f2)
  - site_page: https://blog.christophetd.fr/stop-worrying-about-allowprivilegeescalation (fetched 2026-08-29T09:47:04.077233+00:00, sha 306e080b0c79)
  - site_page: https://christophetd.fr (fetched 2026-08-29T09:47:04.074735+00:00, sha 64b0ee285788)
- Data as of 2026-08-30T08:39:29.467469+00:00.