Glossary
What Is Origin-IP Discovery?
Origin-IP discovery — also called de-cloaking or de-CDN — is finding the true server IP behind a CDN or reverse proxy like Cloudflare. The CDN hides the origin, but historical DNS, certificates, SPF records, and sibling domains often leak it, so an attack-surface or pentest team can reach the real host their scanner actually needs to test.
How Whisper models it
The whisper.origins procedure reconstructs likely origin IPs from passive DNS, certificate, and mail evidence already in the graph.
Why the origin is hidden
A CDN or reverse proxy sits in front of the real server: visitors hit the CDN edge, and the origin's IP never appears in current DNS. That protects the origin from direct attack — and frustrates a defender or pentester who needs to assess the actual host, not the CDN.
How the origin leaks
The origin usually exposed itself before the CDN was added, or exposes itself sideways. Historical DNS records, an old A record on a subdomain that bypasses the CDN, the SPF record's mail servers, a TLS certificate that names the origin, or a sibling domain on shared hosting — any of these can reveal the real IP. Passive sources keep that history even after the front door is closed.
Passive beats active
Classic de-CDN tools brute-force certificates or scan address space, which is loud and often blocked. Reading the leak from a pre-joined graph of DNS, certificate, SPF, and hosting history is quiet and reaches what active tricks miss — the candidate origins, confidence-ranked, without touching the target.
See it in practice
Run it live in these use cases: Map an org's whole attack surface.
Where this shows up
See it in a live investigation: Find the real infrastructure behind the CDN.
Go hands-on with the recon recipes.