Bypassing CDN to Find the Real IP: A One-Click Tool for Unmasking Origin Servers

Exhaust every possible method, strip a CDN down to its underwear, and find the real IP.

An automated CDN origin tracing skill built for Claude Code. Enter a target domain, and it automatically runs 40+ OSINT methods in priority order, builds an evidence chain, and outputs a final verdict.

╔══════════════════════════════════════════════════╗║  Real IP:  103.***.**.32                        ║║  Confidence:  Certain (95%+)                            ║║  Location:  Shenzhen, Guangdong, China · China Telecom                     ║║  Evidence:  [S] Exact SSL certificate match                    ║║          [A] Historical DNS record confirmation                     ║║          [A] HTTP behavior difference verification                     ║╚══════════════════════════════════════════════════╝

What it can do

No matter which CDN the target is hiding behind—Cloudflare, Tencent EdgeOne, Alibaba Cloud, AWS CloudFront, Akamai, Fastly, Azure, Imperva, Sucuri, Huawei Cloud, Wangsu, Baidu Cloud, or even any unknown CDN not on the list—FUCK-CDN will try methods in order from lowest to highest cost:

If P0 hits, it stops—not a single Token wasted. Only if it misses does it escalate to the next level. P0-P3 plus CDN-specific/general bypasses all fail? P4 will exhaust every unconventional method and keep grinding to the end. After finding a candidate IP, it automatically enters the verification phase—SSL certificate comparison + HTTP behavior comparison + IP reverse lookup—triple cross-validation, producing a confidence rating.

Installation

Option 1: Clone the entire project (recommended)

git clone <repo_url> FUCK-CDNcd FUCK-CDNclaude

After cloning, start Claude Code directly in the project directory, and the skill loads automatically.

Option 2: Install only the skill file

If you already have your own project, just copy the skill file into it:

# Run in your project root directorymkdir -p .claude/skillscurl -o .claude/skills/fuck-cdn.md \  <repo_raw_url>/.claude/skills/fuck-cdn.md

Or do it manually:

1. Download .claude/skills/fuck-cdn.md

2. Place it in your project's .claude/skills/ directory (create it if it doesn't exist)

3. Start Claude Code in the project directory

Option 3: Global installation (available to all projects)

# Place it in the user-level skills directory, shared by all projectsmkdir -p ~/.claude/skillscp .claude/skills/fuck-cdn.md ~/.claude/skills/

Verify installation

After starting Claude Code, type / to view the list of available skills, and you should see fuck-cdn.

Usage

Basic usage

Call it directly in Claude Code:

/fuck-cdn example.com

Or use natural language:

Help me find the real IP of example.com

API Key configuration

There are two ways to configure API Keys:

Option 1: Edit the Skill file directly (recommended, set it once and you're done)

Open .claude/skills/fuck-cdn.md, find the API Key configuration section at the top, and fill in your Keys:

SHODAN_API_KEY     = "your Key"FOFA_EMAIL         = "your email"FOFA_API_KEY       = "your Key"CENSYS_API_ID      = "your ID"CENSYS_API_SECRET  = "your Secret"SECURITYTRAILS_KEY = "your Key"ZOOMEYE_API_KEY    = "your Key"QUAKE_API_KEY      = "your Key"HUNTER_API_KEY     = "your Key"VIRUSTOTAL_KEY     = "your Key"

Once filled in, they are used automatically on every call, with no need to re-enter them.

Security note: If your project is a public repository, do not commit a skill file containing Keys. It is recommended to add .claude/skills/fuck-cdn.md to .gitignore, or only fill in Keys in a local/global installation (~/.claude/skills/).

Option 2: Provide them temporarily in the conversation

Tell Claude your Keys directly in the conversation; they are used only in the current session memory and are not written to any file

My Shodan key is xxxx, FOFA email is xxx, key is xxxHelp me find the real IP of example.com

Supported platforms

You can still get by without any keys. None of the methods in the P0 and P1 stages (historical DNS, certificate comparison, subdomain enumeration, HTTP behavior analysis) require a key, and their hit rates are already quite high. The value of keys comes into play in the P2 stage—spatial search engines can significantly boost the hit rate against well-defended targets.