Put a target behind Cloudflare or Akamai and most scanners happily report the CDN edge. That is useful for footprinting, but it is not the IP the red team needs when the engagement scope includes the origin, the bypass path, or proving that grey-clouding actually held.
origin-recon is CDN origin-IP discovery and exposure reconnaissance for authorized security assessments. A single target flows through passive intelligence — favicon and TLS-cert correlation, passive DNS history, reverse-IP co-hosting — then live DNS work — certificate transparency, wildcard detection, AXFR attempts, altdns permutations — and finally HTTP probing with direct-IP validation. Candidates are enriched with BGP/ASN context and graded by confidence: high when a TLS SAN or body-hash match proves the backend, medium when passive DNS or HTTP response suggests it, low when the correlation is weak enough that a human should decide.
The operator controls the aggression. --passive skips all active probing. --tor routes HTTP egress through a SOCKS proxy and fails closed if Tor is unreachable. Active stages are gated behind scope confirmation unless the operator explicitly authorizes them. Reports leave as terminal tables, Markdown, HTML, JSON, or SARIF; batch mode and CI exit codes support recurring checks against a domain list.
This is the local, full-power build: your API keys, your egress, your scope file. A reduced public-web variant without operator keys is a separate future artifact. The useful output is not a pile of Shodan hits — it is a ranked candidate list with the validation path that got you there, diffable between rescans so exposure regressions do not hide in a folder of stale HTML.