domains / families / security / origin-ip-discovery

origin-ip-discovery

separate

Discover origin IPs behind CDN/WAF via favicon hash, DNS history, and SSL certs.

When to use

• Target is behind Cloudflare/Akamai and returns 403 or CAPTCHA challenges on all requests.
• You need direct access to the origin to bypass WAF rules.
• Subdomain enumeration reveals internal/staging hosts on non-CDN IPs.
• The target uses a single favicon across all infrastructure.
• SSL certificates share the same organization name across IPs.

Skill page

Source