cloudflare resolver

CloudFlare Resolver Transparency

Unlike our competitors, Cloud Booter's CloudFlare resolver never keeps resolver logs

Learn more

CloudFlare Resolver

When you want to locate someone, anywhere in the world, it’s usually simple. There are plenty of Internet sites which will help you find people based on their name, age and other search parameters you may have available. No special assistance, like the “CloudFlare resolver” we’ll discuss shortly, is necessary.
When you want to locate someone based on their Internet connection, it’s also pretty easy in most cases. That’s because every computer that sends or receives information online is identified by an “IP address” – its Internet address. In the same way that the post office uses a street address to know where to deliver a letter, the interconnected computer networks which make up the Internet determine where to request or deliver information by means of IPs. There are lots of online sites which will tell you a computer’s general location based on its IP address, or “translate” a site’s URL or an email address to its associated IP. However, some people or companies take steps to hide their IP address so they can’t be easily found – or in some cases, so they can’t be the target of online assaults such as Distributed Denial of Service (DDoS attacks). One common method of obscuring an IP is through the use of CloudFlare, and a way around the problem is a CloudFlare resolver.

What is CloudFlare?

Established in 2009, CloudFlare operates a fleet of web servers all over the world, which work as intermediaries between client websites and the people visiting them. There are two purposes for this service.
First, it can greatly speed up the delivery of content to a surfer, because CloudFlare keeps (or “caches”) each website’s most commonly requested resources on each of its servers, and delivers that content from the location closest to the surfer. It also can access and deliver non-cached content more quickly because its size gives it priority Internet transfer routes.
Just as importantly (and more importantly for those curious about CloudFlare resolvers), CloudFlare can protect its clients from many Internet attacks. The reason is simple: anyone using normal means to determine the IP of a CloudFlare client’s website won’t see the site’s real IP address but will instead see one of CloudFlare’s IPs, since the intermediate service, and not the actual target site, is receiving all requests for content. Only CloudFlare is communicating with the site via its true IP.
It’s easy to see why many people pay for this service. It can save as much as 60% of the bandwidth costs that a website would normally pay in order to respond to surfer requests, and allows the site to load in a visitor’s browser twice as fast. It also allows CloudFlare’s advanced threat detection and mitigation systems to protect their site. (These systems include analysis of incoming IP addresses and denying access to perceived threats, and spreading server load caused by DDoS attacks across all 23 of the company’s datacenters while working to deny requests from what appear to be CloudFlare resolvers).
OK, now that you understand the playing field, it’s time to move on to the key question.

What is a CloudFlare Resolver?

A CloudFlare resolver bypasses the protection provided by the service, in order to determine the “real” IP address of a website or user. This isn’t as easy as it might sound, since all of CloudFlare’s systems are designed to prevent this exact scenario from occurring. Running IP booters and Skype resolvers are relative child’s play compared to what most CloudFlare resolvers have to go through to find a true IP address.
There are several reasons why people would want to use a CloudFlare resolver. Some might need to uncover the real person or company behind a website, in order to serve legal papers, collect a debt, or enforce copyright claims. It can also be useful if you are a CloudFlare client and want to make sure your IP is property protected. Other uses, though, are more nefarious; the only reliable way to launch a DDoS attack against a CloudFlare-protected website is to obtain the website’s true IP so detection, protection and mitigation processes can be bypassed.
Most CloudFlare resolvers are privately-operated with their methods closely guarded. One “public” technique which could be used in the past involved pinging a website’s subdomains or suspected subdomains (like webmail.example.com, ftp.example.com and mail.example.com). Since each subdomain is treated by most services as a unique and separate domain, this often allowed a CloudFlare resolver to gather information which would allow the user to figure out the root domain’s IP. However, CloudFlare has fixed this hole in their system, to a large extent.
Other, more successful approaches are based on two important facts: CloudFlare does not handle email operations for its client sites, and many sites rely on outside advertising revenue in order to survive. In both cases, a website’s true IP (or its “nameservers” which are translatable into IP addresses) may be publicly obtainable. It’s possible for a savvy website operator to hide his site’s email operations so the real IP address isn’t detectable, but many either don’t bother or don’t know how to protect their MX (mail service) records. When it comes to the use of outside advertising services on a website, there’s a real opportunity to obtain a site’s true information by probing an ad service’s records or databases – something over which the website owner has no control whatsoever. Similar uses are available in Skype resolver services, also offered at Cloud Booter.

Using a CloudFlare Resolver

Finding the inside details of sites protected by CloudFlare can be extremely difficult unless you’re an experienced and creative programmer, so it’s not really advisable to try to create a CloudFlare resolver on your own.
A much better alternative is utilizing one of the online sites offering CloudFlare resolver services. Some of these tools are free to use, some operators will request donations in appreciation of their service, and many others will charge for the process or require you to buy a membership. Some are very good at returning the true IP of a website while others will often come up empty. That means you may have to test several CloudFlare resolvers to find one which performs up to the level you expect, but it’s a much simpler and faster approach to “getting inside” CloudFlare than tinkering with your own homemade resolver.