What Is Cloudflare? How Can You Bypass It?

Hello guys! Today I have decided to start a technical series. This series would contain technical stuff like networking, firewall, and other tech stuff. Alright, let’s not get off topic. What is Cloudflare? How to bypass Cloudflare? Well, here is the answer to what is Cloudflare.

Let’s see what has Wikipedia got to say about Cloudflare.

Cloudflare, Inc. is a U.S. company that provides content delivery network services, DDoS mitigation, Internet security and distributed domain name server services, sitting between the visitor and the Cloudflare user’s hosting provider, acting as a reverse proxy for websites. Cloudflare’s headquarters are in San Francisco, California, with additional offices in London, Singapore, Champaign, Austin, Boston and Washington, D.C.

For me, Cloudflare is just a wall that I can jump off using some simple and easy-to-use tool. But if the website owner decides to configure the Cloudflare properly, then surely it cannot be bypassed. But for now, let’s begin learning how to bypass Cloudflare.

What do the Cloudflare do to protect the website from attacks?

Cloudflare adds a browser integrity check. In this check, the visitor of the website has to wait 5 seconds before he/she is allowed to access the website. During these 5 seconds, the Cloudflare’s Javascript checks the browser of the visitor and its connection type. If the connection is made forcefully with the same IP but multiple times, the Cloudflare blocks the access of the website and shows a CAPTCHA challenge. It does not completely block the visitor, but depending on the behavior it shows up the challenge. The screenshot below shows the 5 seconds of browser integrity check by Cloudflare to prevent DDoS attacks.

browser integrity check before bypass cloudflare


How to bypass Cloudflare?

To prevent the direct access to the server, Cloudflare hides the origin IP of the web server and replaces it with its own protected IP. But there are some techniques through which we can bypass Cloudflare security and get to know the origin IP.

Whenever a domain’s name-server is updated and pointed to a hosting provider’s service, the hosting provider takes over access to all the sub-domains on the domain and adds some of its own sub-domain such as “mail”, “panel”, etc. For example, if you own a domain “example.com”, when you point it’s name-server to the hosting provider’s service, the hosting provider adds a sub-domain as “mail.example.com”, “cpanel.example.com”, etc. The hosting provider assigns one server to the website and that server is having all the same IPs on the same domain. In order to not let the out-going email conflict connections, Cloudflare does not change the IP address of the “mail” sub-domain. So when we ping “mail.example.com”, we find the real IP.

Let’s prepare a list of possible sub-domains that can probably be pointing the origin name server. For example mail, email, admin, panel, panel, cp. control panel, admin panel,admincp,apanel,acp, mod, music, test, www, and etc. And the list goes on, you can ping all the possible words as a sub-domain and see which one does not point Cloudflare IP.

This job looks hard, right? But ShadowCrypt’s Cloudflare resolver does the same in less than a second. It analyses about 100+ words and pings them all. It does find which sub-domain is valid and which is not. After finding all the IPs, the resolver shows you the note-Cloudflare IP in the result.

How to bypass Cloudflare using ShadowCrypt’s Cloudflare resolver?

This is the easiest job but still, I would show you how to do it properly. So let’s begin.

1. Go to ShadowCrypt.club and on the left sidebar, find the “CloudFlare Resolver” from the list and click on it. You will be redirected to the Cloudflare Resolver page.

shadowcrypt pointing cloudflare resolver


ShadowCrypts Cloudflare Resolver

Now type the Cloudflare domain in the box. Press “Resolver/Submit” in the orange button to resolve the website. After you press the resolver button, it will show you the resolved IP address of the domain you’ve entered.

Link to ShadowCrypt’s Cloudflare Resolver.

Alright, guys, that’s all for now. From now onwards, I will be posting technical stuff on my blog. If you have any difficulty resolving Cloudflare IP, let me know in the comment section below with your E-Mail address, I will bypass the Cloudflare website and email the origin IP to you. Thank you once again and have a great day ahead 🙂

One thought on “What Is Cloudflare? How Can You Bypass It?

  • April 20, 2019 at 2:47 pm

    Thank you very much! I was shocked to see how easily my website is bypassable. I will now take necessary steps to protect my website from being bypassed.


Leave a Reply

Your email address will not be published. Required fields are marked *