在使用cloudflare worker搭建的vless或者cloudflare zero时会面临优选ip或者优选域名的问题，这里记录以下个人在使用的解决方案，相对比较便捷且稳定。
先介绍两个概念：
1. 优选ip
优选ip是对cloudflare自身的ip，根据自己的网络环境进行筛选出来的一些质量较好的ip.
2. 反代ip（ProxyIP）
这些ip本身不是cloudflare的ip，因为一些原因被设置了对cloudflare ip的流量转发，也就是对cloudflare ip的中转，也成为中转ip.由于cloudlfare自身的限制，使用CFvless时如未设置ProxyIP会导致cloudflare系的网站都不能正常访问，也就是 ASN13335 都不能访问。
寻找可以优选的ip
借用 fofa.info 使用fofa语法可以便捷的找到想要的ip或域名，这些域名和ip一个最大的特征就是使用了cloudflare的证书服务。
主要的特点是 server="cloudflare".
参考语法：
1 | cert="cloudflare"&&country="US"&&is_domain=true |
可以参考fofa语法记录
寻找可用的反代ip
反代ip的一个显著特点就是header="Forbidden" && server="cloudflare"
国内反代IP：server==”cloudflare” && port==”80” && header=”Forbidden” && country==”CN”
剔除CF：asn!=”13335” && asn!=”209242”
阿里云：server==”cloudflare” && asn==”45102”
甲骨文韩国：server==”cloudflare” && asn==”31898” && country==”KR”
搬瓦工：server==”cloudflare” && asn==”25820”
1 | server="cloudflare" && banner="Forbidden" && country="US" && is_domain=true && port="443" |
一些大佬维护的反代ip
1 | CM 维护 |
想要不不跳ip就解析下要是使用的反代域名，挑选符合要求的ip固定就行了。
这里并不打算详细的介绍fofa的语法，需要的自行到fofa去了解。为了便于汇总在fofa筛选的结果，我写一个油猴脚本，可以方便的复制结果中的域名和ip,当然你也可以登录fofa使用官方的下载服务，写脚本的目的主要是为了更便捷。脚本上传到到了greasyfork.org，你可以在 FOFA IP and Domain Extractor下载，配置进油猴或者手机端的stay\injectscript都可以使用。当然如果你不想使用脚本，只是偶尔需要这个功能，你也可以将以下代码在浏览器的console里运行，得到相同的结果。
- console运行脚本
1
console.log([...document.querySelectorAll('.hsxa-meta-data-list .hsxa-meta-data-list-lv1-lf span.hsxa-copy-btn')].map(e => e.dataset.clipboardText).filter((value,index,self)=>self.indexOf(value)===index).filter(text => !text.includes(':')).join(','));
- FOFA IP and Domain Extractor
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101// ==UserScript==
// @name FOFA IP and Domain Extractor
// @namespace http://tampermonkey.net/
// @version 1.1
// @description Extract IP addresses and domains from FOFA search results and display them at a specific location with a copy button
// @author zephyrus
// @match https://fofa.info/result*
// @match https://*.fofa.info/result*
// @grant GM_setClipboard
// @downloadURL https://update.greasyfork.org/scripts/490160/FOFA%20IP%20and%20Domain%20Extractor.user.js
// @updateURL https://update.greasyfork.org/scripts/490160/FOFA%20IP%20and%20Domain%20Extractor.meta.js
// ==/UserScript==
(function() {
'use strict';
// Create a MutationObserver instance
let observer = new MutationObserver(function(mutations) {
// Check if the target element exists
let targetElement = document.querySelector('div#__layout > div > div.contentContainer.resultIndex > div:nth-child(1) > div.relatedSearch.relatedSearch-padding');
if (targetElement) {
// If the target element exists, stop observing
observer.disconnect();
// Check if the IP display has already been inserted
if (document.getElementById('ipDisplay') || document.getElementById('domainDisplay')) {
return;
}
// Extract the IP addresses and domains
let elements = [...document.querySelectorAll('.hsxa-meta-data-list .hsxa-meta-data-list-lv1-lf span.hsxa-copy-btn')]
.map(e => e.dataset.clipboardText.replace(/^(http|https):\/\//, ''));
let ipRegex = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/;
let domainRegex = /^([a-zA-Z0-9][a-zA-Z0-9-]{1,61}[a-zA-Z0-9]\.)+[a-zA-Z]{2,}/;
let ips = elements.filter(text => ipRegex.test(text)).filter((value, index, self) => self.indexOf(value) === index) // .join(',');
// Remove port numbers from IP addresses
ips = ips.map(ip => ip.split(':')[0]);
let ipList = ips.join(',');
let domains = elements.filter(text => domainRegex.test(text)).filter((value, index, self) => self.indexOf(value) === index).join(',');
// Create a new element to display the IP addresses
let ipDisplay = document.createElement('div');
ipDisplay.id = 'ipDisplay';
ipDisplay.textContent = 'IPs: ' + ips;
ipDisplay.style = 'margin-top: 10px; word-wrap: break-word; background-color: #333; color: #fff; padding: 10px; border-radius: 5px; font-size: 14px; width: 85%; margin-left: 7.5%; margin-right: 7.5%;';
// Create a new element to display the domains
let domainDisplay = document.createElement('div');
domainDisplay.id = 'domainDisplay';
domainDisplay.textContent = 'Domains: ' + domains;
domainDisplay.style = 'margin-top: 10px; word-wrap: break-word; background-color: #333; color: #fff; padding: 10px; border-radius: 5px; font-size: 14px; width: 85%; margin-left: 7.5%; margin-right: 7.5%;';
// Create a copy button for IPs
let copyButtonIPs = document.createElement('button');
copyButtonIPs.textContent = 'Copy IPs';
copyButtonIPs.style = 'margin-left: 10px; background-color: #007bff; color: #fff; border: none; padding: 5px 10px; border-radius: 5px; cursor: pointer;';
copyButtonIPs.onclick = function() {
GM_setClipboard(ips);
alert('IPs copied to clipboard!');
};
// Create a copy button for Domains
let copyButtonDomains = document.createElement('button');
copyButtonDomains.textContent = 'Copy Domains';
copyButtonDomains.style = 'margin-left: 10px; background-color: #007bff; color: #fff; border: none; padding: 5px 10px; border-radius: 5px; cursor: pointer;';
copyButtonDomains.onclick = function() {
GM_setClipboard(domains);
alert('Domains copied to clipboard!');
};
// Add the copy buttons to the displays
ipDisplay.appendChild(copyButtonIPs);
domainDisplay.appendChild(copyButtonDomains);
// Insert the new elements before the target element
targetElement.parentNode.insertBefore(ipDisplay, targetElement);
targetElement.parentNode.insertBefore(domainDisplay, targetElement);
}
});
// Start observing the document with the configured parameters
observer.observe(document, { childList: true, subtree: true });
})();
对ip或域名进行优选
地区网络不同、时段不同，ip的连接速度、可用性和稳定性都会不同，也就是动态的，这就需要不间断的对ip或域名进行测试，无论是手动或者是使用脚本，本质上都是找到最快速的目标。
优选一定要注意是本地网络环境，关闭所有代理工具包括软路由！
优选ip
- CF-优选官方IP+反代IP二合一脚本-甬哥
手机端可用，比如苹果的ish+curl -sSL https://gitlab.com/rwkgyg/CFwarp/raw/main/point/cfip.sh -o cfip.sh && chmod +x cfip.sh && bash cfip.sh - better-cloudflare-ip
Termux、OpenWrt、Ubuntu、Debian、CentOS、MacOS、Raspbian、Armbian、iSH都可使用。curl https://raw.githubusercontent.com/badafans/better-cloudflare-ip/master/shell/cf.sh -o cf.sh && chmod +x cf.sh && ./cf.sh
优选域名
推荐使用优选域名，减少维护的凭此，一个域名对应有一个ip池，优点是相对稳定，缺点是会跳地区（同一域名解析的不同ip可能对应不同地区）。手机端也可用curl -sSL https://gitlab.com/rwkgyg/CFwarp/raw/main/point/CFcdnym.sh -o CFcdnym.sh && chmod +x CFcdnym.sh && bash CFcdnym.sh
更多可以阅读文章 How to find proxyip for VLESS CF WORKERS using Cybersecurity / Cyberspace Search Engine
- Shodan (https://shodan.io/)
Keywords:
port:80 product:”CloudFlare” title:”Direct IP access not allowed”
http.html_hash:141477257 port:443
Censys (https://search.censys.io/)
Keywords:
((((((services.http.response.html_title=”400 The plain HTTP request was sent to HTTPS port”) and services.port=443) and services.software.product=”CloudFlare Load Balancer”) and services.software.vendor=”CloudFlare”) and services.http.response.headers: (key: Server and value.headers: cloudflare)) and services.service_name=”HTTP”) and services.transport_protocol=”TCP”
((((((services.http.response.html_title=”Direct IP access not allowed | Cloudflare”) and services.port=80) and services.software.product=”CloudFlare Load Balancer”) and services.software.vendor=”CloudFlare”) and services.http.response.headers: (key: Server and value.headers: cloudflare)) and services.service_name=”HTTP”) and services.transport_protocol=”TCP”
FOFA (https://en.fofa.info/)
Keywords:
server==”cloudflare” && port=”443” && is_domain=false && banner=”CF-RAY: -“ && banner=”Content-Length: 155” && banner=”HTTP/1.1 400 Bad Request” && protocol=”http”
server==”cloudflare” && port=”80” && is_domain=false && banner=”CF-RAY: -“ && banner=”Content-Length: 16” && banner=”HTTP/1.1 403 Forbidden” && protocol=”http”
Pulsedive (https://pulsedive.com/explore/)
Keywords:
port=80 and port=443 && technology=CloudFlare && type=ip && http.cf-ray= - && http.++code=400 && http.Content-Length=655
Zoomeye (https://zoomeye.org/)
Keywords:
+app:”Cloudflare http proxy” +port:”443” +service:”http” +title:”400 The plain HTTP request was sent to HTTPS port”
+app:”Cloudflare” +port:”443” +service:”http” +title:”400 The plain HTTP request was sent to HTTPS port”
+app:”Cloudflare http proxy” +port:”80” +service:”http” +title:”Direct IP access not allowed”
+app:”Cloudflare” +port:”80” +service:”http” +title:”Direct IP access not allowed”
Hunter (https://hunter.how/)
Keywords:
ip.port==”443”&&product.name=”CloudFlare”&&header.status_code==”400”&&protocol==”http”
Criminal IP (https://criminal.ip/)
Keywords:
- port:80 product: “cloudflare” title: Direct IP access not allowed - Cloudflare
another website but I haven’t found the keyword yet
website lainnya, tetapi saya tidak menemukan kata kuncinya
- BinaryEdge (https://app.binaryedge.io/)