Expand description
Origin IP Discovery Engine.
Breaks through CDNs/WAFs using heuristic scanners (DNS, SSL, HTTP headers, favicon hashing, DNS history, etc.) to uncover the direct origin IP for WAF-bypass networking.
Each scanner is feature-gated so consumers can pick exactly what they need. All scanners run in parallel and results are aggregated by confidence score.
§Scanners
| Scanner | Feature | API Key? | Confidence |
|---|---|---|---|
| DNS misconfig (MX, SPF, DMARC, bypass subs) | dns_misconfig | No | 60-85 |
| SSL certificate transparency (crt.sh) | ssl_cert | No | 70 |
| HTTP header leaks | http_header | No | 50-90 |
| Favicon hash (Shodan + Censys) | favicon | Optional | 80 |
| DNS history (SecurityTrails/ViewDNS) | dns_history | Optional | 85-90 |
| Historical DNS (Censys, DNSDB, CIRCL, PassiveTotal) | — | Optional | 70-85 |
Re-exports§
pub use types::OriginCandidate;pub use types::ValidationState;
Modules§
- scanners
- sources
- External passive discovery sources for origin IP candidates.
- types
- Origin discovery data types — candidate origins and evidence.
- util
- Shared utilities for origin discovery — IP filtering, bounded I/O, etc.
- validator
- Active origin validation — host-header swap and 404 fingerprinting.
Functions§
- discover_
origin - Discover the origin IP of a given domain behind a CDN/WAF.