musana/CF-Hero

What it is

CF-Hero is a Go tool (needs go1.18) that finds the origin IP behind a Cloudflare-protected domain. It gathers candidate IPs from several sources, connects to each over HTTP(S), and compares the returned HTML title with the target's title. A match is reported as the real IP.

How it works

Each candidate source depends on a specific misconfiguration or historical leak:

• A records: a domain can have several A records, some outside Cloudflare ranges, which exposes the origin.
• TXT records: it extracts every IP from TXT records, mainly SPF ip4: entries, because a company hosting its own mail server may share an IP with the web origin.
• OSINT engines: Shodan, Censys and ZoomEye may have logged the origin before the domain moved behind Cloudflare.
• Historical DNS: SecurityTrails (-securitytrails) can reveal past A records.
• Related domains: with -td and -dl, it connects to the IPs of non-Cloudflare subdomains or sibling domains of the same company. It sends the target's Host header and checks whether the target's site answers.

What to do

Install:

go install -v github.com/musana/cf-hero/cmd/cf-hero@latest

The default run checks A and TXT records only:

cat domains.txt | cf-hero
cf-hero -f domains.txt

Add sources with -zoomeye, -censys, -shodan and -securitytrails. Run the related-domain technique like this:

cf-hero -td https://musana.net -dl sub_domainlist.txt

-cf and -non-cf list which input domains are or are not behind Cloudflare. Other flags are -w (workers, default 16), -ja3, -ua and -px (proxy URL).

API keys go in ~/.config/cf-hero.yaml, one list per service (zoomeye, securitytrails, shodan, censys).

If Cloudflare blocks the first request, the fetched title will be "Just a moment...". Pass the real title with -title to avoid false mismatches.

Preconditions

• The origin must have leaked through one of the channels above. The tool finds nothing if none applies.
• The origin must answer direct requests, and the related-domain method also depends on the server's configuration, as the page notes.
• Shodan's /dns/domain endpoint needs a paid Membership.
• Censys now uses the Censys Platform API, because the legacy search.censys.io API is being sunset in 2026. Put a Personal Access Token first in the censys list. Paid accounts must add an Organization ID as the second entry. Without it the API returns Free-tier permissions and may give HTTP 403 with no results.
• The page notes that Shodan and Censys have API quota limits.

Caveats

• Validation compares HTML titles only, so a shared or generic title can produce a false positive. The page does not describe any deeper content comparison.
• The "Other options" usage example uses a -d flag that is not in the listed flags. Prefer -f, stdin or -td.
• The page lists favicon search and ViewDNS integration as future work. Neither exists yet.
• The page gives no accuracy figures or tested success rates.