Overview
AS13335 is Cloudflare’s single global ASN. Cloudflare anycasts the same IP prefixes from every one of its 300+ data centers, meaning a connection to a Cloudflare IP from Vietnam reaches Singapore, while the same IP from Germany reaches Frankfurt. The complete IPv4 and IPv6 range lists are publicly available at /ips-v4 and /ips-v6 and are stable — they change rarely.
Services on these IPs
A Cloudflare IP could be fronting any of: a customer website (CDN/proxy), Workers serverless code, Cloudflare Pages static sites, R2 object storage, WARP VPN, Cloudflare Tunnel endpoints, Magic Transit / Spectrum routing. Single IP can serve millions of distinct domains via SNI. Note that 1.1.1.1 / 1.0.0.1 (public DNS) are operated by Cloudflare under a separate APNIC partnership and are NOT in the standard /ips-v4 list.
How to detect Cloudflare IPs
Reverse DNS rarely identifies Cloudflare uniquely (PTRs are often customer-controlled or absent). Definitive checks: ASN lookup (AS13335) or matching the IP against /ips-v4 + /ips-v6. The "CF-Ray" response header on HTTP responses also confirms Cloudflare proxying.
When this matters
Origin servers add Cloudflare IP ranges to their allowlist so only Cloudflare can connect — protecting against origin discovery attacks. SOC teams investigate suspicious Cloudflare-fronted traffic. Researchers map the website-to-IP graph from public Cloudflare ranges.
Caveats
Cloudflare ranges are anycast — geolocation databases often report them as US-based (Cloudflare HQ) regardless of which PoP a user actually hits. The real geographic location requires looking at the CF-IPCountry header set by Cloudflare itself.