Skip to content
🔎 Find origin servers of websites behind CloudFlare by using Internet-wide scan data from Censys.
Python Dockerfile
Branch: master
Clone or download


CloudFlair is a tool to find origin servers of websites protected by CloudFlare who are publicly exposed and don't restrict network access to the CloudFlare IP ranges as they should.

The tool uses Internet-wide scan data from Censys to find exposed IPv4 hosts presenting an SSL certificate associated with the target's domain name.

For more detail about this common misconfiguration and how CloudFlair works, refer to the companion blog post at

Here's what CloudFlair looks like in action.

$ python

[*] The target appears to be behind CloudFlare.
[*] Looking for certificates matching "" using Censys
[*] 75 certificates matching "" found.
[*] Looking for IPv4 hosts presenting these certificates...
[*] 10 IPv4 hosts presenting a certificate issued to "" were found.

[*] Retrieving target homepage at

[*] Testing candidate origin servers
        responded with an unexpected HTTP status code 404
        timed out after 3 seconds

[*] Found 2 likely origin servers of!
  - (HTML content identical to
  - (HTML content identical to

(The IP addresses in this example have been obfuscated and replaced by randomly generated IPs)


  1. Register an account (free) on
  2. Browse to, and set two environment variables with your API ID and API secret
$ export CENSYS_API_ID=...
$ export CENSYS_API_SECRET=...
  1. Clone the repository
$ git clone
  1. Install the dependencies
$ cd cloudflair
$ pip install -r requirements.txt
  1. Run CloudFlair (see Usage below for more detail)
$ python


$ python --help

usage: [-h] [-o OUTPUT_FILE] [--censys-api-id CENSYS_API_ID]
                     [--censys-api-secret CENSYS_API_SECRET]

positional arguments:
  domain                The domain to scan

optional arguments:
  -h, --help            show this help message and exit
                        A file to output likely origin servers to (default:
  --censys-api-id CENSYS_API_ID
                        Censys API ID. Can also be defined using the
                        CENSYS_API_ID environment variable (default: None)
  --censys-api-secret CENSYS_API_SECRET
                        Censys API secret. Can also be defined using the
                        CENSYS_API_SECRET environment variable (default: None)

Docker image

A lightweight Docker image of CloudFlair (christophetd/cloudflair) is provided. A scan can easily be instantiated using the following command.

$ docker run --rm -e CENSYS_API_ID=your-id -e CENSYS_API_SECRET=your-secret christophetd/cloudflair 

You can also create a file containing the definition of the environment variables, and use the Docker--env-file option.

$ cat censys.env 

$ docker run --rm --env-file=censys.env christophetd/cloudflair


Tested on Python 2.7 and 3.5. Feel free to open an issue if you have bug reports or questions.

You can’t perform that action at this time.