You go to look up the IP address behind a website. The result comes back: 104.21.48.20. You check it: Cloudflare, Inc., San Jose, California. But the company that owns the website is based in Berlin. Something is not adding up.
What you are seeing is not a mistake in the lookup tool. You are seeing a CDN at work.
What a CDN actually does
A Content Delivery Network is a system of servers distributed around the world that sits in front of your "origin" server, the actual machine running your application. When a visitor in Tokyo requests your website, they connect to a Cloudflare data center in Tokyo rather than your server in Frankfurt. The CDN serves cached content from nearby, and only fetches from your origin when necessary.
Cloudflare operates over 300 data centers as of 2026 and claims that roughly half of all HTTP traffic on the internet passes through its network. Akamai, which predates Cloudflare by over a decade and was the CDN that Amazon and Apple relied on before building their own, operates over 4,000 edge locations. AWS CloudFront, Fastly, and Google Cloud CDN round out the major players.
The routing trick that makes this work is called anycast. Multiple Cloudflare data centers announce the same IP address to the global BGP routing system. When you connect to a Cloudflare IP, your traffic automatically routes to the nearest data center handling that prefix. The IP is the same worldwide. The destination is whichever server is geographically or topologically closest.
Why IP lookups return CDN addresses
When a domain is proxied through Cloudflare, its DNS A records point to Cloudflare's IP ranges, not to the origin server. Tools like our WHOIS Lookup will accurately report that the IP belongs to Cloudflare, because it does. The actual origin IP is hidden behind the proxy layer.
This is a deliberate design choice, not a side effect. Hiding the origin IP is one of Cloudflare's core security features. If attackers do not know your origin IP, they cannot bypass Cloudflare and attack your server directly. In practice, the origin IP often leaks through other channels, which we will get to shortly.
The orange cloud and what it means
In Cloudflare's dashboard, each DNS record has a cloud icon. An orange cloud means the record is proxied through Cloudflare. Requests to that hostname go through Cloudflare's edge. A grey cloud means DNS-only mode: Cloudflare resolves the DNS but does not proxy the traffic, which means the real server IP is publicly visible.
The distinction matters enormously for security. A grey-clouded record for mail.yourdomain.com exposes your mail server IP, which is often the same machine or same subnet as your web server. This is one of the most common ways that researchers and attackers find the hidden origin IP for Cloudflare-protected sites.
How the origin IP leaks anyway
Despite Cloudflare's best efforts, origin IPs surface through several channels. The most common is historical DNS records: before you added Cloudflare, your domain's A record pointed directly at your server. Services like SecurityTrails and Shodan index this historical data. If you set up Cloudflare after your site went live, your real IP is probably already catalogued somewhere.
Subdomains are the next major leak. While example.com is proxied, direct.example.com, ftp.example.com, or mail.example.com might not be, and if any of those resolve to your server, the origin IP is visible.
SSL certificates also reveal information. Certificate Transparency logs (crt.sh indexes all publicly issued TLS certificates) show every certificate ever issued for your domains and subdomains. A subdomain you forgot about, issued a certificate for years ago, might be in there with the real IP.
Finally, some applications include server-side headers or error messages that expose internal IP addresses. A misconfigured application sending X-Backend-Server: 198.51.100.42 in its HTTP response tells anyone listening exactly where to find the origin.
What the headers tell you
Cloudflare adds several HTTP headers to requests it proxies to the origin server. CF-Connecting-IP contains the real visitor IP. X-Forwarded-For contains the same. True-Client-IP is similar. These headers let your application code see who is actually visiting, rather than seeing Cloudflare's IP on every request.
For anyone inspecting traffic from the visitor side, this means you cannot easily discover the origin IP from response headers. Cloudflare strips or rewrites headers that might reveal origin server information in the response.
When IP lookups should show Cloudflare
For any major website with significant traffic, seeing Cloudflare (or Fastly, or Akamai) in an IP lookup is completely normal and expected. Wikipedia uses Fastly. GitHub uses Fastly. Stripe uses Cloudflare. If you look up stripe.com and see a Cloudflare IP, that is correct. It is not a sign that something is wrong with the lookup tool.
Where lookups do show origin IPs is for smaller sites that have not yet set up a CDN, for services using "DNS only" Cloudflare mode, and for subdomains that handle backend or mail traffic.
Frequently asked questions
Can I find the real IP behind a Cloudflare site?
Sometimes. Check historical DNS records via SecurityTrails or RiskIQ. Check crt.sh for subdomains. Check MX records for the mail server IP. Look for any subdomain not showing in the Cloudflare dashboard as proxied. There is no guarantee, and well-configured setups will have closed these gaps.
Does using a CDN affect my site's SEO?
Positively, generally. CDNs reduce latency, which improves Core Web Vitals, which are a Google ranking factor. The IP the CDN uses does not factor into SEO.
Why does the same domain return different IPs on different lookups?
CDNs often return different IP addresses based on the geographic location of the query, as part of load balancing and anycast routing. This is expected behavior, not an error.
Does Cloudflare store my visitors' data?
Cloudflare processes all traffic passing through its edge, including encrypted traffic (it terminates TLS). Their privacy policy and the GDPR implications of routing European traffic through US-based infrastructure have been contested in European courts. Organizations with strict data residency requirements should review this carefully.
Check who owns an IP or domain: WHOIS Lookup and DNS Lookup.