[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fARLRHbIC7WKUicv5wVwz1DH8vZghodndiG8nCxfSFEc":3},{"article":4,"iocs":46,"watch_terms":54,"solutions":55,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"51bbb7e6-a44a-4312-b64a-b30ec5640238","Catching Cloudflare WARP Leaking Real IPs Through Tor | AI-Native security platform","catching-cloudflare-warp-leaking-real-ips-through-tor-ai-native-security-platfor-66d110","AI-Native security platform: Deceive, Detect, Respond. “We turn that hard truth into your tactical advantage. Our AI-based decoys, built using our open-source framework, deceive attackers during lateral movement within the network. While intruders interact with the decoys, our AI-driven SOC monitors, analyzes, and responds in real time. Catching threats that evade traditional defenses, including zero-days and supply chain compromises. Deploy in under 2 minutes. Gain immediate threat intelligence, auto-isolate compromised systems, and eliminate false positives. Turning your network into an intelligent adversary. Honeypot AI, SOC AI, Honeypot framework.","A security researcher discovered that Cloudflare's managed WARP Gateway service injects HTTP headers (including Cf-Connecting-Ip and the undocumented Cf-Warp-Tag-Id) before traffic enters Tor, exposing users' real IP addresses. The Cf-Warp-Tag-Id header persisted across two sessions linking a Finnish VPS to a French residential connection two hours apart, enabling IP correlation. This is an architectural mismatch where HTTP-layer inspection stamps identifying metadata upstream of TCP-layer anonymization, defeating Tor's anonymity guarantees.","Cloudflare WARP Gateway leaks real IP addresses through Tor via undocumented HTTP headers.","https:\u002F\u002Fbeelzebub.ai\u002Fblog\u002Fcatching-cloudflare-warp-leaking-real-ips-through-tor\u002F","https:\u002F\u002Fbeelzebub.ai\u002Fimages\u002Fblog\u002Fwarp-tor-leak.png","2026-04-14T19:19:06+00:00","2026-04-14T20:00:11.764+00:00",8,[17,20,23,25,28],{"name":18,"type":19},"Cloudflare","vendor",{"name":21,"type":22},"Cloudflare WARP Gateway","product",{"name":24,"type":22},"Beelzebub",{"name":26,"type":27},"Tor","technology",{"name":29,"type":22},"Ollama","c70f3a41-2f0c-4608-870d-b8cbcd8be076",{"id":30,"icon":32,"name":33,"slug":34},null,"Cloud Security","cloud-security",[36,41],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51],{"type":48,"value":49,"context":50},"ip","65.109.30.32","Hetzner VPS in Helsinki used by attacker in Phase 1 direct reconnaissance and Phase 4 return",{"type":48,"value":52,"context":53},"2a01:e0a:fe2:4de0:fac:5473:377e:1cde","French residential IPv6 (AS12322, Free SAS) linked to same attacker via persistent Cf-Warp-Tag-Id in Phase 3",[18,21,24],{"controls":56,"vendors":140},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":87,"name":88,"problem":89,"products":90},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"slug":116,"name":117,"problem":118,"products":119},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[120,127,133],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":121,"product_name":124,"url":125,"description":126},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":128,"product_name":129,"url":131,"description":132},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":116,"product_name":137,"url":138,"description":139},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[141],{"slug":142,"name":18,"logo_path":143,"roles":144},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png",[145],"affected",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":156},"cloudflare-warp-gateway-exposes-real-ips-through-http-header-injection","Cloudflare WARP Gateway Exposes Real IPs Through HTTP Header Injection","Cloudflare's WARP Gateway service was found to inject identifying HTTP headers (Cf-Connecting-Ip and Cf-Warp-Tag-Id) before traffic entered the Tor network, completely defeating Tor's anonymity protections. This represents a fundamental architectural flaw where HTTP-layer inspection occurs upstream of TCP-layer anonymization, creating persistent identifiers that can correlate user sessions across different IP addresses. The issue demonstrates how improper service configuration and inadequate privacy controls can compromise user anonymity even when using privacy-focused tools like Tor.",[151,152,153,154,155],"CIS Control 12","NIST PR.DS-1","NIST PR.DS-5","GDPR Article 25","ISO 27001 A.13.2.1",{}]