Recon
Classify hosts as CDN, WAF, or cloud by IP
Detect CDN, WAF, and cloud technology for a given IP or hostname.
overview
What cdncheck does
cdncheck tells you whether an IP or hostname sits behind a CDN, a WAF, or a cloud provider. That label changes how you treat a target: a CDN edge is not the origin, a WAF shapes what scanners see, and a cloud IP may sit on shared infrastructure you should not probe blindly.
It matches addresses against maintained provider ranges and can name the service, from Cloudflare and Fastly to AWS and Azure. -match-cdn and -filter-cdn keep or drop hosts by provider so you can split a list into edges to skip and direct origins worth scanning. -jsonl makes those decisions programmatic.
Trickest runs cdncheck as a managed Recon node: IP, DNS name, or file in; file and folder of labels out. Run it after resolution to tag the host list, then route only non-CDN, non-WAF addresses into heavier scanning stages.
use cases
Where cdncheck fits
Tag hosts by CDN, WAF, or cloud
Classify a resolved host list so you know which addresses are edge nodes, which sit behind a WAF, and which are direct cloud or origin IPs.
Skip CDN edges before scanning
Filter out CDN and WAF addresses so a port scanner or vulnerability scanner spends its time on origins rather than shared edge infrastructure.
Match a specific provider
Use the match flags to keep only hosts behind a named provider like Cloudflare or AWS when an assessment targets one platform.
Drive decisions with JSONL
Emit JSONL so downstream nodes branch on the CDN, WAF, and cloud labels automatically instead of relying on manual inspection.
reference
cdncheck inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input | STRING | -input | IP or DNS name to process. |
| inputs | FILE | -input | File of IPs or DNS names to process. |
| cdn | BOOLEAN | -cdn | Display only CDN hits in CLI output. |
| waf | BOOLEAN | -waf | Display only WAF hits in CLI output. |
| jsonl | BOOLEAN | -jsonl | Write output in JSON lines format. |
| match-cdn | STRING | -match-cdn | Match hosts behind a named CDN (cloudfront, fastly, google, leaseweb, stackpath). |
| match-waf | STRING | -match-waf | Match hosts behind a named WAF (akamai, cloudflare, incapsula, sucuri). |
| filter-cdn | STRING | -filter-cdn | Filter out hosts behind a named CDN provider. |
Showing key inputs. cdncheck exposes 21 inputs in total.
Full flag reference (21 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| cdn | BOOLEAN | -cdn | display only cdn in cli output |
| waf | BOOLEAN | -waf | display only waf in cli output |
| resp | BOOLEAN | -resp | display technology name in cli output |
| cloud | BOOLEAN | -cloud | display only cloud in cli output |
| input | STRING | -input | ip / dns to process |
| jsonl | BOOLEAN | -jsonl | write output in json(line) format |
| retry | STRING | -retry | maximum number of retries for dns resolution (must be at least 1) (default 2) |
| inputs | FILE | -input | list of ip / dns to process |
| silent | BOOLEAN | -silent | only display results in output |
| exclude | BOOLEAN | -exclude | exclude detected ip from output |
| verbose | BOOLEAN | -verbose | display verbose output |
| no-color | BOOLEAN | -no-color | disable colors in cli output |
| resolver | STRING | -resolver | list of resolvers to use (comma separated) |
| match-cdn | STRING | -match-cdn | match host with specified cdn provider (cloudfront, fastly, google, leaseweb, stackpath) |
| match-waf | STRING | -match-waf | match host with specified waf provider (akamai, cloudflare, incapsula, sucuri) |
| resolvers | FILE | -resolver | list of resolvers to use |
| filter-cdn | STRING | -filter-cdn | filter host with specified cdn provider (cloudfront, fastly, google, leaseweb, stackpath) |
| filter-waf | STRING | -filter-waf | filter host with specified waf provider (akamai, cloudflare, incapsula, sucuri) |
| match-cloud | STRING | -match-cloud | match host with specified cloud provider (zscaler, aws, azure, google, office365, oracle) |
| filter-cloud | STRING | -filter-cloud | filter host with specified cloud provider (zscaler, aws, azure, google, office365, oracle) |
| disable-update-check | BOOLEAN | -disable-update-check | disable automatic cdncheck update check |
example
Run cdncheck
# tag IPs and keep Cloudflare WAF hits as JSONLcdncheck -input hosts.txt -waf -match-waf cloudflare -resp -jsonl -silent198.51.100.10 [waf] [cloudflare]198.51.100.22 [cdn] [cloudfront]203.0.113.40 [cloud] [aws]203.0.113.55 [waf] [akamai]198.51.100.90 [cdn] [fastly]203.0.113.100 [cloud] [azure]guidance
Choosing cdncheck
Use cdncheck after resolution to label hosts as CDN, WAF, or cloud and to prune edge nodes before heavy scanning. It classifies addresses; it does not find the origin behind them. Pair with hakoriginfinder for origin hunting. Run it before naabu or nuclei to focus those tools on real origins.
hakoriginfinder
Tries to find the origin behind a proxy. cdncheck identifies that a proxy or WAF is present in the first place.
wafw00f
Fingerprints the specific WAF on a web target. cdncheck classifies CDN, WAF, and cloud by IP range.
asnmap
Maps an organization to its netblocks. cdncheck tells you which of those IPs are CDN or cloud edges.
faq
cdncheck questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run cdncheck yourself
A host list feeds cdncheck, which tags CDN and WAF edges and passes the remaining origins to naabu so only direct IPs are port scanned into a queryable output.
Facts on this page come from the live Trickest tool library.