Origin IP Discovery

Discover the real server IP behind CDN/WAF protections (Cloudflare, Akamai, Fastly). When the origin IP is found, the raw server is exposed without firewall rules, rate limiting, or application-layer filtering. Techniques include favicon hash fingerprinting across Shodan, historical DNS records from passive sources, SSL certificate SAN field matching, and Google Analytics ID cross-referencing.

When to Use

• Target is behind Cloudflare/Akamai and returns 403 or CAPTCHA challenges on all requests.
• You need direct access to the origin to bypass WAF rules.
• Subdomain enumeration reveals internal/staging hosts on non-CDN IPs.
• The target uses a single favicon across all infrastructure.
• SSL certificates share the same organization name across IPs.

Prerequisites

• terminal with curl, python3, and shodan CLI.
• Shodan API key: shodan init <KEY>.
• Target favicon file or URL.

Quick Detection