Cloudflare IP ranges & what they mean for fraud

Cloudflare publishes the egress ranges of its CDN and WARP infrastructure. Most traffic you see *through* Cloudflare carries the visitor’s real IP in headers — these ranges matter when a request *originates* from Cloudflare infrastructure itself.

How Maskbreak uses these ranges

Because Cloudflare is a CDN, the useful distinction is traffic originating from these ranges versus traffic merely served through them — Maskbreak's signal applies to the former. The numbers above come from Cloudflare's own published range feed — the same feed Maskbreak's verdict pipeline refreshes daily, so a new range is scored within a day of publication, not whenever a static database ships.

Range data adds a signal; it never overrides deeper network detection. VPN exits live in datacenters, so a range hit doesn't short-circuit tunnel analysis — an IP in Cloudflare's ranges that is also a VPN exit gets both signals, and your policy sees the full picture in the reasons array.

What these ranges actually cover

Cloudflare publishes the IPv4 and IPv6 ranges its network uses. These cover the reverse-proxy edge that fronts millions of customer sites, WARP client exits, and Workers egress.

This is the range list most often misused. Cloudflare's addresses appear in your logs as the source of proxied traffic to sites behind Cloudflare — but a visitor's real address is never a Cloudflare address. If you see one on your own origin, the usual explanation is your own proxy configuration, not an attacker. WARP exits are the genuine exception: a consumer VPN product egressing from Cloudflare space.

Where this provider shows up in abuse

Because WARP is a mainstream consumer privacy product rather than an abuse tool, treating Cloudflare space as high-risk will flag ordinary people using their phone's VPN toggle.

None of this makes a range match a verdict. In Maskbreak's pipeline a datacenter hit contributes 40 points toward a 0–100 risk score — enough to reach review, never enough to block on its own — and it never short-circuits tunnel detection, because VPN and proxy exits are themselves hosted in datacenters. Which AS announces a given address is a separate question, answered in the ASN directory.

Should you block Cloudflare traffic?

A request originating from CDN infrastructure (rather than being proxied through it for a website) is unusual for a human visitor — commonly a Worker, a WARP exit, or automation.

The honest answer is: it depends on the surface. A datacenter IP on a signup, login, or checkout is a strong review signal — humans overwhelmingly arrive from residential and mobile networks. The same IP calling your API is often just a legitimate backend. Maskbreak returns the raw signal so you can apply exactly that asymmetric policy instead of a blanket block.

curl -X POST https://maskbreak.com/v1/evaluate \
  -H "Authorization: Bearer sk_test_sandbox" \
  -H "Content-Type: application/json" \
  -d '{"token":"test_datacenter"}'

The sandbox key returns the documented datacenter-verdict shape (decision, risk_score, network.datacenter) — no signup required. Details in the API docs.