5 ms·
The Easy Way to Obtain a Website's IP Address That Hides Behind CloudFlare
- EE84M3i 6y agoTL;DR get the origin to send you an email and look at the email headers. This won't work for lots of sites. I'd expect it probably also doesn't work sites that use most mail API providers, but maybe some of them have SMTP interfaces and preserve the headers.
- junaru 6y agoDoesn't work if they use any transactional mail service.
- some_furry 6y agoThis is the easy way. A more effective way is to ask CloudFlare for MX records, or to look at IP address history for the domain name, but it's less easy (especially for nontechnical people). Signing up for an account and looking at email headers, then typing their IP address into a WHOIS service to get the web hosting company to file abuse reports with? You can do that without ever touching a command line interface.
- robjan 6y agoIf they use a third party mail provider like Gsuite or Fastmail that won't work. If they really want to hide their IP they would do this or entirely avoid MX records.
- some_furry 6y agoMost open source PHP eCommerce platforms don't have out-of-the-box support for the specific providers you're thinking of, and most scam operations like this are low-effort.
- JackC 6y agoIt does if you use a service's SMTP relay. For example, this header is from an email sent via Mailgun SMTP from Hetzner (digits replaced with ): Received: from hetzner-dc-ex-* (static.....clients.your-server.de [...]) by mxa.mailgun.org with ESMTP id *; Thu, 06 Feb 2020 17:27:22 -0000 (UTC)
- gruez 6y agoYou can't send a DMCA request to cloudflare directly?
- some_furry 6y agoCloudFlare has, historically, been very resistant to taking stuff down. See the waxing poetic in the post about why they took down a Nazi propaganda site, for context: https://blog.cloudflare.com/why-we-terminated-daily-stormer https://blog.cloudflare.com/why-we-terminated-daily-stormer