Websites, Domains & Internet Infrastructure · WDH-025

Why does the IP address belong to Cloudflare or another intermediary?¶

Because the intermediary may sit in front of the website’s origin infrastructure. The visible address usually identifies the public-facing service layer, not automatically the host, operator or person responsible for the content.

Services such as Cloudflare can provide content delivery, reverse proxying, encryption, security filtering and protection against disruptive traffic. As a result, the domain may resolve to an address controlled by the intermediary while the origin server remains hidden behind it.

What the result may show¶

The address may establish that:

• the domain was configured to use the intermediary;
• users connected through that provider’s infrastructure; and
• the intermediary may hold customer, configuration, security or request records.

It does not by itself identify:

• the origin host;
• the hosting customer;
• the website operator; or
• the person who published the content.

Follow the service chain¶

Different records may sit with different organisations:

• registrar — domain-registration records;
• intermediary — customer, configuration and traffic records;
• origin host — infrastructure and access records;
• website platform — content and publishing activity;
• payment provider — transaction and beneficiary records.

Record the hostname, address, date, time and basis for identifying the intermediary. Current results may not reflect the position during the relevant period.