While doing penetration testing for a client I stumbled upon a security incident. CloudFlare promises to hide the origin IP address when using its DNS.
I went to dnsdumpster.com, inputted my client's domain and there I found my client's ORIGIN IP ADDRESS, which should've been hidden. In CloudFlare DNS the corresponding records are all proxied.
How is this a thing?
Isn't that exactly what CloudFlare should be protecting against?
Anyone can lookup this IP and DDoS it directly while ignoring the CloudFlare network.
P.S MX, SPF, A records on a subdomain pointing to another IP for a mail server is setup and that IP is visible (as it should be).