My cloudflared website is leaking IP on “zoomeye” | Hacker News Reader

My cloudflared website is leaking IP on “zoomeye”

1 pointlustaly4 comments

I have a website that have cloudflare.

I looked for ways to bypass Cloudflare. I realized I was able to achieve this with Zoomeye.

How can I prevent my site's real IP from showing up on Zoomeye?

Probably not the answer you're hoping for, but why do want to hide your real IP? If it's for general security I would just firewall off you server from IPs that don't belong to Cloudflare and call it good. If it's for other reasons (running legally questionable stuff for example) I would guess Cloudflare would give you up easily to law enforcement so not worth it there either.

Allow only these ranges:

    curl -s -X GET "https://api.cloudflare.com/client/v4/ips" | jq -r '.result.ipv4_cidrs[]'

I am planning to do this as a last chance, thank you.

Seems zoomeye (.org) is a hosted service similar to shodan. I don’t think cloudflare is leaking your ip but rather your server is. Assuming they just crawl ips and make educated guesses, I’d say deny all traffic that doesn’t come from cloudflare for starters. Does your http server being accessed by its ip show anything about your domain?

I think the leak was caused by a problem with my certificate settings. I think I fixed the problem.. Thanks.

Reply on news.ycombinator.com