IP history of a site behind a CDN

Addresses of a proxied site

When a Cloudflare DNS record is proxied, queries for it are answered with Cloudflare anycast addresses (Cloudflare documentation). The address of the server behind it, the origin, does not appear in DNS. The recent history of a domain behind a CDN shows addresses from the CDN's network, such as Cloudflare (AS13335).

Cloudflare lists its address ranges at cloudflare.com/ips. Many unrelated sites are served from the same CDN addresses: another domain on the same address does not show a common owner.

Location of CDN addresses

An anycast address is announced from many locations at once, and each visitor reaches a nearby one. A GeoLite2 database gives one location per address. The country shown for a CDN address does not tell you where the site is served from or where its server is.

MaxMind leaves its anycast field empty in the GeoLite2 City database this site uses, and states that IP geolocation is inherently imprecise (MaxMind documentation). The result page cannot mark an address as anycast; the network name, such as Cloudflare, is the better clue.

Addresses recorded before the CDN

Cloudflare notes that historical DNS records are kept and can contain the addresses a site used before joining Cloudflare (Protect your origin server). The oldest rows of a history may show such addresses, if they were collected. A row shows only that the domain pointed to that address at the recorded date.

The address may have been reassigned since. On AWS, the standard public IPv4 address of an instance goes back to Amazon's pool when the instance stops, and a released Elastic IP address can be allocated to another AWS account (AWS documentation on public IPv4 addresses and Elastic IP addresses). An old address can now belong to an organisation with no connection to the site.

Testing an address requires permission

Sending requests to an old address to find out whether it still serves the site means testing a system you may not own. Do it only with permission: within a bug bounty program whose scope explicitly lists that address, or with the written agreement of whoever holds the address today. A program that covers the site does not cover an address that now belongs to someone else.

Reducing the exposure of an origin server

Cloudflare recommends rotating origin IP addresses once a site is onboarded. Its Protect your origin server page also recommends:

• proxying the DNS records that point to the origin;
• blocking traffic that does not come from Cloudflare's IP ranges;
• Cloudflare Tunnel, which connects the origin to Cloudflare without a publicly routable IP address;
• Authenticated Origin Pulls, which checks that requests to the origin come from Cloudflare.

Other CDNs document equivalent settings. Look up your own domain to see which of your earlier addresses were recorded; if one of them still reaches your server, changing it removes that path.

Behind a CDN, the 300 records a page shows at most can all be CDN addresses: if the counter shows more, check the rest on Profundis before concluding that no earlier address was recorded.

Checking a CDN label in the results

A network name such as Amazon does not identify a particular AWS service. IP History labels an address CloudFront only when it matches the published CloudFront service ranges. It also checks sources such as Cloudflare and F5 Distributed Cloud. Outside those ranges, an address announced by a CDN's own network, such as Akamai's AS20940 in PeeringDB, is labelled with that CDN too. Addresses in Google's ranges outside the ones it lists for Google Cloud customers are labelled Google services: Google uses them for its own services.

Akamai also runs caches inside internet provider networks. In a history with Akamai CDN addresses, addresses from 32 of these networks, such as Swisscom (AS3303) and Arelion (AS1299), are labelled Akamai caches in ISP networks, unless a published range names them. The list comes from this site's records on 2026-10-19: each network had at least three addresses, recorded for at least three domains, and at least 95% of those domains also had Akamai CDN addresses. Networks of companies that use Akamai for their own sites were left out. The label is inferred from these records and cannot tell a cache from a site's own server in the same network.

Range lists refresh when the server starts and once a day. If a source is unavailable or returns an invalid list, the tool keeps its last valid copy or the bundled fallback. The list of CDN networks, the two Cloudflare prefixes checked in RIPEstat and the list of Akamai cache networks are not downloaded: they are maintained by hand, and each match shows the date of that review or measurement. A range match describes that checked copy and cannot establish which provider held an address at a past observation date.

Histories containing only recognised CDN addresses remain available for a lookup but are excluded from the domain directory and search indexing. Mixed histories can be listed when their dated addresses outside recognised CDN ranges and networks provide enough information over time. When CDN addresses are half of a history or more, one network outside them must also appear on dates at least a week apart. Missing dates are shown in the result summary.

For addresses outside recognised CDN ranges, the hosting history guide compares platform addresses and explains changes within one provider.