Developer builds tool to detect origin IP exposure that bypasses CDN protections

A developer discovered that websites behind CDNs like Cloudflare or CloudFront can still be vulnerable if their origin server's IP address is publicly reachable. Attackers can uncover origin IPs through Certificate Transparency logs, historical DNS records, and overlooked subdomains such as mail or vpn that are never routed through the CDN. To address this, the developer built a Rust-based command-line tool called origin-exposure-check that replicates attacker discovery methods against a user's own domain. The tool enumerates candidate IPs, excludes known CDN edge ranges, and directly probes each remaining IP by forcing a TLS connection while spoofing the real hostname to see if the origin responds with site content. If the response matches the CDN-served baseline, the origin is flagged as exposed, giving site owners an early warning before attackers can exploit the gap.