Finding domains associated with Cloudflare account

Posted on Edited on

Introduction

Recently, I stumbled upon a domain using Cloudflare services and got curious about what other domains might be tied to the same Cloudflare account. So, I started looking into using reverse NS (Name Server) lookup methods. Here’s how I approached it and the tools that proved effective.

Understanding Cloudflare NS Format

When you sign up for a Cloudflare account, you get two unique name servers that look something like this:

1
2
random-boy-name.ns.cloudflare.com 
random-girl-name.ns.cloudflare.com

These name servers are used for all domains linked to your Cloudflare account, making it easier to track down other domains connected to it.

How I Did It

To find domains associated with a Cloudflare account using their name servers, I tried out several reverse NS lookup services. Many of these tools only let you search one name server at a time, which can be a bit of a hassle. But I found that search.dnslytics.com stood out as a reliable option.

Using search.dnslytics.com

  1. Getting Started: Signing up on search.dnslytics.com gives you access to their reverse NS lookup tool. The basic free version gives you about 50 results per query, but if you opt for their paid subscription (which costs 26 euros per month), you can dig deeper and get 80 to 100 results per query.
  2. Running the Query: To pinpoint domains using specific Cloudflare name servers, you simply enter the following query: 
    1
    ns: "random-boy-name.ns.cloudflare.com" and ns: "random-girl-name.ns.cloudflare.com"

This command fetches a list of domains using these particular name servers, revealing other domains tied to the Cloudflare account you’re interested in.

Conclusion

Using tools like search.dnslytics.com for reverse NS lookups is a smart way to uncover domains sharing Cloudflare services under the same account. Keep in mind that while some domains might use the same name servers coincidentally, this method is generally effective for discovering associated domains.

Give reverse NS lookup a try to explore and analyze domains efficiently, gaining valuable insights into Cloudflare account associations.

TL;DR

  1. Register account on search.dnslytics.com.
  2. Choose domains in a search bar.
  3. Enter this query: 
    1
    ns: "random-boy-name.ns.cloudflare.com" and ns: "random-girl-name.ns.cloudflare.com"
  4. profit