Networks (ASN) / AS13335

AS13335 Cloudflare, Inc.

CDN / reverse proxy / DNSUS

Cloudflare's anycast network: CDN edge, WAF, 1.1.1.1 DNS, WARP VPN and Workers. Roughly a fifth of all websites sit behind it.

An address in AS13335 is almost never the origin server — it is Cloudflare's edge terminating the connection. Geolocation returns Cloudflare's registration (San Francisco) or the nearest data centre, not the website owner's location. If you are trying to find who hosts a site behind Cloudflare, the IP will not tell you.

Outbound traffic from AS13335 includes Cloudflare Workers, WARP / Zero Trust clients (consumer "VPN"), and Cloudflare's own crawlers. WARP users are legitimate humans whose real IP is hidden; many geolocation services flag WARP as a VPN.

Well-known addresses in AS13335

1.1.1.11.0.0.1

Frequently asked questions

Is Cloudflare a VPN?

WARP is a VPN-like client that routes traffic through Cloudflare, so an AS13335 visitor may be a WARP user. Most AS13335 addresses you encounter, however, are the CDN edge in front of websites.

Why does every website resolve to a Cloudflare IP?

Because those sites use Cloudflare as a reverse proxy. The real origin IP is hidden behind the edge.