# Cloudflare ## Identification Cloudflare appears as an autonomous-system attribution context, a multi-cloud API-governed edge service, and the anycast proxy behind observed GoMcGill DNS addresses. Its proxy addresses must not be mistaken for origin-server geolocation. ## Notebook evidence - [[Scanned_20260730-1659#PDF page 33 — Cloudflare firewall and autonomous-system numbers|PDF page 33: Cloudflare firewall and autonomous-system numbers]] — The listed ASNs correctly identify major network operators: Google AS15169, Meta/Facebook AS32934, Microsoft AS8075, OVH AS16276, and Amazon AS14618. An ASN identifies a routing domain, not an individual server or application. Cloudflare’s proxied DNS uses its anycast network to answer for customer hostnames and can obscure the origin address from ordinary DNS lookups. The page was building a firewall/attribution table that connected traffic to infrastructure owners. - [[Scanned_20260730-1659#PDF page 38 — Cloud, analytics, and router-domain blocklist|PDF page 38: Cloud, analytics, and router-domain blocklist]] — This is a manually curated network-deny list mixing cloud storage, CDNs, analytics/customer-experience platforms, email/productivity infrastructure, font delivery, and router-administration domains. Several strings are misspelled or may be app-specific subdomains; they must not be treated as confirmed ownership mappings. Apple’s privacy-manifest model now explicitly distinguishes domains contacted for tracking, illustrating the later institutionalization of the notebook’s manual domain-attribution practice. - [[Scanned_20260730-1659#PDF page 39 — Telemetry, advertising, payment, and analytics domains|PDF page 39: Telemetry, advertising, payment, and analytics domains]] — The list moves deeper into mobile telemetry and advertising supply chains: crash/analytics endpoints, communications infrastructure, payment/subscription services, ad exchanges, bidders, and behavioral analytics. Blocking all entries indiscriminately could break core functionality; the page is better understood as **attribution before policy**. - [[Scanned_20260730-1659#PDF page 65 — Cloud-provider and identity architecture dated August 8, 2021|PDF page 65: Cloud-provider and identity architecture dated August 8, 2021]] — The August 8, 2021 page is a cloud control-plane inventory: registrar/DNS, edge proxy, virtual servers, object/media delivery, identity-as-a-service, VPN, file storage, secure email, and owned domains. The emphatic Cloudflare API note points toward programmatic orchestration. This is the clearest notebook-wide architecture: **domain → DNS/edge → compute → media → authentication → secure transport → storage → mail**. - [[Scanned_20260730-1659#PDF page 66 — GoMcGill DNS addresses and GoDaddy support transfer|PDF page 66: GoMcGill DNS addresses and GoDaddy support transfer]] — The three addresses were Cloudflare anycast endpoints for `gomcgill.com` at the time written; Cloudflare’s proxy model intentionally returns Cloudflare addresses rather than the origin. The page’s “pings” are therefore evidence of edge routing, not direct evidence of where the origin server lived. The support-representative transfer records a human escalation layered onto the DNS investigation. Credential/PIN material remains redacted. ## Relationships and overlays The source places this record in an evidence cluster with [[Adobe Typekit|Adobe Typekit]] · [[Amazon S3 Dual-stack Endpoint|Amazon S3 Dual-stack Endpoint]] · [[Amazon Web Services|Amazon Web Services]] · [[Anycast|Anycast]] · [[Auth0|Auth0]] · [[Autonomous System Number|Autonomous System Number]] · [[BidSwitch|BidSwitch]] · [[Box|Box]] · [[Cloud API|Cloud API]] · [[Cloudinary|Cloudinary]] · [[Crazy Egg|Crazy Egg]] · [[Criteo|Criteo]] · [[DigitalOcean|DigitalOcean]] · [[DigitalOcean Spaces|DigitalOcean Spaces]] · [[Domain Blocklist|Domain Blocklist]] · [[Domain Name System|Domain Name System]] · [[GoDaddy|GoDaddy]] · [[GoMcGill|GoMcGill]]. The occurrence contributes to the notebook's larger model of [[Identity Continuity|identity continuity]], [[Device Sovereignty|device sovereignty]], and [[Continuity Architecture|continuity architecture]]. ## Evidentiary status and open leads Recover firewall rules and timestamps; distinguish ASN-level ownership from hostname-, certificate-, and process-level attribution. ## Source - [[Scanned_20260730-1659|Scanned_20260730-1659]]