cfhunt — find the origin behind Cloudflare

Domains to hunt (up to 5, comma or space separated)

try:

Passive only — don't contact any candidate IP Grey-cloud label sweep (direct, cpanel, mail, …) Extra free sources (urlscan, RapidDNS, subdomain.center) Refresh Cloudflare IP ranges

Stages 1–5 are passive (public certificate-transparency logs + keyless DNS-over-HTTPS). Verification contacts candidate IPs presenting Host/SNI as your domain — only run it against hosts you own or are authorized to test.