Why does the IP address belong to Cloudflare or another intermediary?¶

Because the domain has been configured to send public traffic through that provider before it reaches the website’s origin infrastructure.

What the lookup is showing¶

Services such as Cloudflare combine reverse proxying, content delivery, encryption and security filtering. DNS therefore returns an address controlled by the intermediary. The origin server can remain hidden behind it.

This is expected architecture, not evidence that the intermediary owns the website. It is like finding a business address through a mail-handling centre: the centre is part of the delivery route but is not automatically the sender or business operator.

Different evidence sits at different layers. The registrar may hold domain-account records; the intermediary may hold customer, configuration, security and request records; the origin host may hold server and access data; and a website platform may hold content and publishing history.

The visible address can establish that the hostname used the intermediary at a recorded time. It does not by itself identify the origin host, hosting customer, operator or publisher.

Record the exact hostname, address, date, time, time zone and lookup source. Current DNS may not describe the relevant historic period. Use provider and historic records to follow the chain rather than attempting to bypass the service.