[Home](https://servhidden.com/) / [Privacy Hosting Guides](https://servhidden.com/guides) / Hiding Your Origin Server IP: CDNs, Reverse Proxies and What Still Leaks Privacy # Hiding Your Origin Server IP Absorbing an attack and staying unfindable are two different problems, and the arrangement that solves one can quietly undo the other. What network-level filtering covers, what a CDN adds and costs, how origins actually get found — and how to check yours. [Read the guide](#guide-body) [FAQ](#guide-faq) ## On this page - [Guide](#guide-body) - [FAQ](#guide-faq) - [Related guides](#guide-related) - [Recommended pages](#guide-cta) No KYC Crypto Only No Logs DMCA Ignored Full Root NVMe SSD 15 min read Updated Aug 2026 On this page [01Two problems that look like one](#two-problems-that-look-like-one) [02What your host already does, and where it stops](#what-your-host-already-does-and-where-it-stops) [03What a CDN hides, and the abuse desk you inherit](#what-a-cdn-hides-and-the-abuse-desk-you-inherit) [04The six ways an origin address leaks anyway](#the-six-ways-an-origin-address-leaks-anyway) [05Locking the origin so only the front can reach it](#locking-the-origin-so-only-the-front-can-reach-it) [06Your own front node instead of a CDN](#your-own-front-node-instead-of-a-cdn) [07Choosing, in one table](#choosing-in-one-table) [08The account is usually the weakest link](#the-account-is-usually-the-weakest-link) [09Auditing your own exposure in ten minutes](#auditing-your-own-exposure-in-ten-minutes) [10When the address is already burned](#when-the-address-is-already-burned) [11The short version](#the-short-version) [FAQCommon questions](#guide-faq) [→Recommended pages](#guide-cta) "Should I put a CDN in front of it?" is the first question most people ask after buying an offshore server, and it has no single answer, because it is really two questions wearing one coat. Absorbing an attack and staying unfindable are different problems with different solutions, and the arrangement that solves one can quietly undo the other. The confusion is expensive in both directions. People put a large American CDN in front of content they chose [DMCA-ignored hosting](https://servhidden.com/dmca-ignored-hosting) for, and hand a complaints desk back to precisely the kind of intermediary they were avoiding. Others skip everything, get hit by an application-layer flood that network filtering was never designed to see, and conclude the DDoS protection was a lie. This guide separates the two problems, says what each layer genuinely does, and spends most of its length on the part that decides the outcome either way: the six ways an origin address leaks when everything else is configured correctly. ## Two problems that look like one Anything you put in front of a server is doing one of two jobs: keeping an attack away from it, or keeping its address unknown. They overlap enough to be confused and differ enough that solving the wrong one is a waste of money. | What you are worried about | What actually solves it | What does not | | --- | --- | --- | | A volumetric flood filling your pipe (layers 3 and 4) | Network-edge filtering at the host, included on every plan here | Nothing you install on the server — by then the pipe is already full | | An application flood of requests that look real (layer 7) | A CDN or WAF, caching, rate limits, cheaper endpoints | Packet filtering, which sees valid HTTP and passes it | | Nobody should be able to reach the box directly | A front (CDN or your own node) *plus* a firewall that accepts only it | A CDN alone, if the origin still answers the whole internet | | Nobody should learn who runs it | No-KYC signup, payment privacy, account discipline | Any amount of infrastructure — this is an identity question | | The content must survive complaints | Jurisdiction, and a host that does not act on them | A CDN, which **adds** a complaints channel rather than removing one | Read the last row twice, because it is the one that catches people. Everything else on this page is engineering. That row is not. Whatever sits in front of your server also stands between you and the people who complain about it — which is protection in one direction and a new address for notices in the other. ## What your host already does, and where it stops Layer 3 and layer 4 filtering is included on every plan we sell, at no extra cost, and it runs at the network edge rather than on your server — which is the only place it can work, since a saturated uplink cannot be fixed by anything running behind it. Bandwidth is unmetered, so an attack does not turn into an invoice. For the large majority of what people call "a DDoS", that is the whole story. What it cannot see is the other kind. Five hundred requests a second to a search endpoint from forty thousand residential addresses is not malformed traffic; it is traffic. Slowloris connections that trickle a header every few seconds are, individually, polite. A login form hammered with real POST bodies is indistinguishable at the packet level from a busy Monday. No packet filter helps, because there is nothing wrong with the packets. **The test for whether you need more than network filtering:** can one well-formed request cost your server a database scan, an image resize, or a password hash? If yes, you have a layer-7 surface, and the fix is caching, rate limiting and cheaper endpoints — with or without a CDN in front of them. There is one direction of traffic we do act on, and it is worth stating plainly: attacks and mass spam *originating* from our network may be null-routed to keep the rest of the infrastructure healthy. That is an operational measure, not a content one — the distinction our [DMCA-ignored hosting guide](https://servhidden.com/guides/dmca-ignored-hosting-explained) draws in more detail. ## What a CDN hides, and the abuse desk you inherit The mechanism is simple and genuinely effective. Your domain resolves to the provider's addresses, clients connect there, and the provider fetches from your origin. The real address never appears in a client's connection, so it cannot be attacked by anyone who only knows the domain. The same trick is why CDN fronting works for [censorship-resistant proxies](https://servhidden.com/censorship-resistant-hosting/v2ray): a censor sees traffic to an address it cannot afford to block. Three things arrive with it, and none is hidden in the small print: - **The edge terminates your TLS.** Traffic is plaintext inside the provider's network by design — that is how caching and filtering work. Whatever your users type reaches a third party before it reaches you. - **An abuse channel that did not exist before.** Complaints can be filed against the CDN directly, and a CDN answers them: by forwarding to you, by naming your hosting provider, or by terminating you. If your reason for being offshore is that complaints go nowhere, putting a US intermediary in front reconnects the chain you paid to break. - **An account.** Email address, payment method, often a phone number, tied to your domain and kept indefinitely. More on that below, because it is usually the weakest link in the whole arrangement. None of that makes a CDN wrong. It makes it a decision with two sides: excellent for a shop or an application with real users and real layer-7 pressure, actively counterproductive for publishing that attracts takedowns. Our own answer to the question on the [DMCA-ignored hosting page](https://servhidden.com/dmca-ignored-hosting) has always been the short version of this: for takedown resistance, use the network filtering you already have and skip the CDN. ## The six ways an origin address leaks anyway This is the section that matters, because concealment is not a product you buy — it is a property you either maintain or lose, usually within days, to one of six things. Origins are found every day behind perfectly good CDN configurations. - **Certificate Transparency logs.** Every publicly trusted certificate issued for your domain is published to public, permanent, searchable logs within minutes. They do not publish your address; they publish your *hostnames* — staging, mail, vpn, the subdomain you set up once in 2024. Each one is a candidate to resolve, and a single record that does not point at the front ends the exercise. - **DNS history.** Passive-DNS services archive every address your domain has ever resolved to. Moving behind a CDN afterwards does not unpublish what was already recorded — concealment has to begin before the domain first resolves, or you need a new address, not a new front. - **Records that cannot be proxied, and the ones you forgot.** Mail exchangers have to point at something reachable. So do an AAAA record left behind when you only proxied IPv4, an old FTP or panel hostname, a wildcard, or the "temporary" development host that is now three years old. - **Anything the server sends.** Mail from the origin carries its address in the Received headers — a password-reset message is self-service disclosure. Webhooks, outbound image fetches, link previews, pingbacks, update checks and crash reporters all reach out from the real address, and anyone who can make your application talk to a host they control learns it. - **Whole-internet scanning.** Every IPv4 address is scanned and indexed continuously by public services, and the results are queryable in seconds. If your origin answers on port 443 with your certificate, or serves your homepage to any Host header, matching it is one query against a body hash, a certificate fingerprint or a favicon hash. This is how most origins are found, and it costs the finder nothing. - **The application talking about itself.** Absolute URLs and redirects containing the raw address, status or metrics endpoints left open, verbose stack traces naming internal hosts, headers that reveal the backend, and the default virtual host that cheerfully serves your site to anyone who asks by address. **Five of those six are configuration, not cryptography.** Nothing in the list is defeated by a larger CDN plan, and nothing in it is exotic — these are the first six things anyone checks, in this order. ## Locking the origin so only the front can reach it Concealment that depends on nobody guessing the address is not concealment. The arrangement only holds when the origin refuses to talk to anyone but the front, so that a leaked address is a nuisance rather than an event. - **Default-deny, then allow the front.** Accept 80 and 443 only from the provider's published address ranges, and refresh that list automatically — the ranges change, and a stale list fails open or fails closed at the worst moment. Everything else, including SSH, belongs on a tunnel or a management address, as in our [first-hour hardening checklist](https://servhidden.com/guides/first-hour-vps-hardening-checklist). - **Authenticate the front.** Client certificates between the CDN and your origin — usually called authenticated origin pulls — mean that even a correct address plus a correct Host header gets nothing without the certificate. - **Better: no inbound ports at all.** An outbound-only tunnel from the origin to the edge, whether the CDN's own connector or WireGuard to a node you run, means the origin never listens on a public interface. Scanning cannot find what does not answer, and this is the single strongest version of the arrangement. - **One virtual host, one Host header.** The default server should return nothing useful. If your site loads by address, it will be matched by a scanner within the week. - **Move mail off the web origin.** Mail has to be reachable and has to identify itself; keep it on its own machine, as the [mail server guide](https://servhidden.com/guides/offshore-mail-server-setup) assumes. - **Verify from outside.** Every check in this list is meaningless run from the server itself. Test from a network that is not yours. ## Your own front node instead of a CDN The third option gets skipped because it has no marketing budget: a small VPS as the public face, an encrypted tunnel back to the machine that holds the data, and nginx or HAProxy passing traffic between them. From the outside it looks like any web server. The real one is somewhere else, with no inbound ports at all. What you get is concealment with nobody else in the arrangement — no third-party account, no external abuse desk, no stranger terminating your TLS. You also get a jurisdiction split that is otherwise hard to buy: the front where the users are, the data where the law suits you, chosen from our [seven locations](https://servhidden.com/locations). And because no identity was attached at signup, the front is disposable — a burned address is replaced in minutes rather than negotiated. What you do not get is anycast capacity. One node has the capacity of one node, and while our network filtering protects it exactly as it protects any other server, a genuinely large volumetric attack is a bandwidth contest that a global network wins. The honest positioning: a front node is the right answer for hiding a heavy or expensive backend — a storage array, a GPU box, a mail server, a database — and for splitting jurisdictions. It is not a substitute for a CDN under sustained layer-7 pressure. ## Choosing, in one table | Your situation | Arrangement | Reasoning | | --- | --- | --- | | Publishing that attracts takedown notices | Direct, no CDN, in a jurisdiction chosen on purpose | A CDN adds a complaints desk that your host deliberately does not have | | Shop or SaaS with real users and layer-7 pressure | CDN in front, origin locked to its ranges | Layer 7 is the problem a CDN is actually built for | | Circumvention endpoint in a censored country | CDN fronting | The censor sees an address it cannot afford to block | | Large static or media traffic | CDN for cache offload | Bandwidth and latency are the point; concealment is a side effect | | Anonymity is the primary requirement | Your own front node, or nothing in front | A third-party account is an identity record you did not have before | | Heavy backend worth hiding | Front node plus outbound-only tunnel | The expensive machine never appears on the public internet | ## The account is usually the weakest link Consider what happens when the infrastructure is perfect and the paperwork is not. The server was paid for in Monero, with no identity documents and no email address — the arrangement described in our [no-KYC hosting](https://servhidden.com/no-kyc-hosting) pages. Then a CDN account is opened with a card, a personal address and a phone number, listing the domain it protects. That account is a stronger, more durable identity record than anything on the server, held by a company that answers subpoenas, and it undoes the payment privacy entirely. The fix is not complicated, only easy to forget: if anonymity is the goal, either the front belongs to you, or the account in front of it is as disposable and as unattributable as the server behind it. [Server OpSec](https://servhidden.com/guides/server-opsec-staying-anonymous) covers this discipline properly, and [our honest answer on offshore anonymity](https://servhidden.com/guides/is-offshore-hosting-truly-anonymous) is blunt about which links in the chain usually break first. They are almost never the technical ones. ## Auditing your own exposure in ten minutes Every item below is something an interested party would check in the first few minutes. Run them yourself, from a machine that is not the server, before you need the answers. - **List every hostname you have ever certified.** Search your apex domain in a Certificate Transparency search engine and resolve each result. Anything not pointing at the front is a leak, including hosts you no longer use. - **Read your own DNS history.** A passive-DNS lookup shows the addresses your domain resolved to before the CDN. If yesterday's origin is still today's origin, the concealment was never real. - **Ask the origin directly.** curl -sI --resolve example.com:443:198.51.100.10 https://example.com/ — if the site answers, your firewall is not restricting the front and anyone with a candidate address can confirm it in one request. - **Ask it rudely.** curl -skI https://198.51.100.10/ should return nothing recognisable. A default virtual host serving your homepage is the most common single mistake on this page. - **Check every record type, not just A.** dig +short AAAA example.com, dig +short MX example.com, and the same for every subdomain the transparency logs revealed. IPv6 left unproxied is a classic. - **Mail yourself from the application.** Trigger a password reset and read the full Received chain. If the origin address is in there, so is it in every message you have ever sent. - **Confirm the ports are shut.** From an unrelated network, nmap -Pn -p80,443 198.51.100.10 should show filtered, not open. - **Search the scanners.** Look up your certificate fingerprint and your homepage's favicon hash in a public internet-scan index. If your origin is indexed, that is how it will be found. ## When the address is already burned Assume it stays burned. An address that has appeared in passive DNS and in scan indexes is in permanent public record, and no configuration change retracts it. The response is mechanical rather than clever. - **Fix the leak first.** Rotating to a new address without closing the hole reproduces the situation within days, and you will have spent a migration to learn nothing. - **Then rotate.** Deploy a replacement — in a different jurisdiction if the reason was legal rather than technical — restore, and cut over. Because no identity was attached to the first server, this is a fresh start rather than a negotiation, which is the practical, unglamorous payoff of buying servers without an account history. - **Prepare the cutover before the emergency.** A short DNS TTL, configuration you can redeploy from a repository and a tested restore turn a bad afternoon into twenty minutes. Nobody arranges this during an attack. - **Retire the old address properly.** Do not park the old server on the old address serving the same content; that is a live confirmation for anyone watching, and it keeps the record fresh. ## The short version Network-level filtering handles volumetric attacks, comes with the server and costs nothing extra. A CDN handles the application layer and hides the origin, at the price of an intermediary that terminates your TLS, answers complaints and knows who you are. Your own front node buys concealment without the intermediary, but not global capacity. Jurisdiction decides the legal question and none of the three touches it. And all of them are undone by one unproxied record, one email from the origin, or one default virtual host. Decide by goal rather than by habit, then spend the ten minutes on the audit — it finds more real exposure than any upgrade. If you want the architecture without the third party, a small [VPS](https://servhidden.com/vps) as a front and the real work on [dedicated hardware](https://servhidden.com/dedicated) behind it is the arrangement we see most often among people who have already been found once. FAQ ## Origin IP and DDoS — common questions ### 01 Does a CDN hide my server's real IP address? It hides it from clients, which is most of the benefit: visitors connect to the CDN and never see your address. It does not hide it from public records that already exist, from anything your server sends outward, or from internet-wide scanners that can match your origin by its certificate or its homepage. And it only works if your firewall stops the origin answering anyone other than the CDN — otherwise the address is one confirmed request away from being useful again. ### 02 Does putting Cloudflare or another CDN in front undo DMCA-ignored hosting? In practice, yes. A CDN is a party to your service and has its own abuse process: notices can be filed against it directly, and it will typically forward them to you, identify your hosting provider, or drop you as a customer. That reconnects the takedown chain that offshore hosting is chosen to break. For content that attracts complaints, the better arrangement is direct hosting in a jurisdiction picked on purpose, with the network-level DDoS filtering that already comes with the server. ### 03 Is layer 3/4 DDoS protection enough on its own? For volumetric attacks — the kind that fill your uplink — yes, and it is the only layer that can help there, because it works before the traffic reaches you. It is included on every plan with unmetered bandwidth, so an attack does not produce a bill either. What it cannot address is a layer-7 flood of well-formed requests. If a single request to your application can trigger a database scan or an image resize, that is where your risk is, and caching, rate limiting and a WAF are the answer rather than packet filtering. ### 04 How do people find the origin IP behind a CDN? Six routes account for nearly all of it: Certificate Transparency logs revealing subdomains that are not proxied, passive-DNS archives holding the address the domain used before the move, records that cannot be proxied such as mail exchangers, outbound connections from the server itself including its own email headers, internet-wide scanning that matches the origin by certificate or page content, and the application leaking its own address through redirects, status endpoints or a default virtual host. None of them requires any skill. ### 05 Can I use a CDN and stay anonymous? Only if the account is as anonymous as the server, which is rarely the case. A CDN account carries an email address, a payment method and often a phone number, tied to your domain and retained indefinitely by a company that responds to legal process. If you paid for the server in Monero without identity documents and then opened a CDN account with a personal card, the account is now the strongest identity record in the arrangement. Either keep the front under your own control, or make the account as disposable as everything else. ### 06 Do I need any of this for a small site? Usually not. A small site on a server with network-level filtering, a default-deny firewall and no services it does not need is a perfectly ordinary and reasonably robust arrangement. The origin question becomes real when there is a specific reason to hide the machine — an audience that includes people who would attack it, a backend worth more than the front, or content whose hosting arrangement you would rather not advertise. ### 07 Should the mail server run on the same IP as the website? No, and this is one of the most common ways an origin is exposed. Mail has to be reachable at an address that cannot be proxied, and every message it sends carries that address in its headers. Running mail on a separate machine keeps the web origin out of every email you send and out of the DNS records anyone can query. It also keeps a mail reputation problem from becoming a website problem. ### 08 My origin IP has already leaked — what now? Treat the address as permanently public, because passive-DNS and scan archives keep it. Close the leak first, whether that is an unproxied record, an email path or a default virtual host, then move to a new address and cut over with a short DNS TTL prepared in advance. Do not leave the old server answering on the old address with the same content. Since nothing about the original server was tied to an identity, replacing it is an ordinary deployment rather than a negotiation with anyone. Related guides ## Keep reading [### How to Choose an Offshore Hosting Jurisdiction in 2026 Buying A practical decision framework for picking an offshore jurisdiction: data-retention law, MLAT exposure, DMCA stance, court speed and real-world enforcement — country by country. 6-question FAQ](https://servhidden.com/guides/choosing-an-offshore-jurisdiction) [### VPS vs Dedicated Server for Privacy-Critical Workloads Buying When a VPS is fine, when shared tenancy is a liability, and when bare metal is the only honest answer. Hardware isolation, hypervisor risk, and cost vs threat model. 6-question FAQ](https://servhidden.com/guides/vps-vs-dedicated-for-privacy) [### Self-Hosted VPN on a No-KYC VPS: WireGuard vs OpenVPN Operations Why a self-hosted VPN beats commercial providers, and how WireGuard and OpenVPN really compare on privacy, performance and operational risk in 2026. 6-question FAQ](https://servhidden.com/guides/self-hosted-vpn-wireguard-vs-openvpn) [### RTX 4090 vs H100 SXM5 for AI Inference (and Where the RTX 5090 Fits) Buying Buying guide: which NVIDIA GPU for self-hosted LLM, image, video, speech, and fine-tuning workloads in 2026. RTX 4090 vs RTX 5090 vs H100 SXM5 vs dual H100 — VRAM, throughput, $/token, when each wins. 6-question FAQ](https://servhidden.com/guides/rtx-4090-vs-h100-for-ai-inference) [### Offshore Windows RDP for MT4 / MT5 / cTrader Forex Trading Operations Complete guide: why a Windows RDP for Forex trading, how to choose a low-latency offshore jurisdiction, MT4 / MT5 / cTrader / Expert Advisor setup, latency to broker servers, and the no-KYC checkout path. 6-question FAQ](https://servhidden.com/guides/offshore-windows-rdp-for-forex-trading) [### DMCA-Ignored Hosting Explained: What It Really Means in 2026 Buying What "DMCA ignored" hosting genuinely buys you, which jurisdictions actually back it up, the workloads that need it, and the copyright traps the term doesn't cover. 6-question FAQ](https://servhidden.com/guides/dmca-ignored-hosting-explained) [### Anonymous Domain Registration with Crypto: WHOIS Privacy in 2026 Privacy A practical 2026 guide to registering domains without revealing your identity: WHOIS regimes by TLD, registrar choice, crypto payment options, and the operational mistakes that leak you anyway. 6-question FAQ](https://servhidden.com/guides/anonymous-domain-registration-with-crypto) [### Crypto Payments for Hosting: Monero vs Bitcoin vs USDT Privacy How payment coin affects what your host learns about you. Privacy, fees, finality and chain analysis exposure for XMR, BTC and USDT — with a clear recommendation. 6-question FAQ](https://servhidden.com/guides/crypto-payments-monero-vs-bitcoin-vs-usdt) [### Is Offshore Hosting Truly Anonymous? An Honest Answer Privacy Offshore, no-KYC hosting removes the identity a normal host collects — but "anonymous" depends on payment, provider logging and your own opsec. Here is what is really traceable. 6-question FAQ](https://servhidden.com/guides/is-offshore-hosting-truly-anonymous) [### The First Hour of VPS Hardening: A Checklist Operations A concrete, ordered checklist to secure a new VPS in under an hour: SSH keys, a firewall, fail2ban, automatic updates, and the attack-surface reduction that stops most opportunistic attacks. 6-question FAQ](https://servhidden.com/guides/first-hour-vps-hardening-checklist) [### What Is No-KYC Hosting? Definition, Legality & How It Works Privacy No-KYC hosting lets you rent a server with zero identity verification — no name, no email, no ID. Here is exactly what it means, how it works technically, whether it is legal, and how to pick a genuine provider. 6-question FAQ](https://servhidden.com/guides/what-is-no-kyc-hosting) [### Is Offshore Hosting Legal? The Honest 2026 Answer Buying Offshore hosting is legal — for you and for the provider. Here is what the term really means, where the legal line actually sits, the myths worth dropping, and how to use it responsibly. 6-question FAQ](https://servhidden.com/guides/is-offshore-hosting-legal) [### How to Pay for Hosting with Monero (XMR) — Step by Step Privacy A step-by-step guide to paying for a VPS or dedicated server with Monero (XMR): why XMR is the most private option, how to get it, and how the checkout works — from invoice to a running server in minutes. 6-question FAQ](https://servhidden.com/guides/how-to-pay-for-hosting-with-monero) [### How to Host a Website Anonymously — A Practical 2026 Guide Privacy A practical, layered guide to hosting a website with no identity attached: the account, the payment, the domain, the jurisdiction, your connection and the content — each layer explained. 6-question FAQ](https://servhidden.com/guides/how-to-host-a-website-anonymously) [### How to Set Up a WireGuard VPN on a VPS — Step-by-Step Guide Operations Build your own private VPN on a VPS with WireGuard: why a self-hosted VPN beats a commercial one, the full setup from install to a connected client, and how to harden it. 6-question FAQ](https://servhidden.com/guides/how-to-set-up-wireguard-vpn-on-a-vps) [### How to Self-Host an LLM on a GPU Server — 2026 Guide Operations Run your own large language model on a rented GPU server: why self-hosting beats an API, which GPU and model to choose, the setup with Ollama or vLLM, and what it costs. 6-question FAQ](https://servhidden.com/guides/self-host-an-llm-on-a-gpu-server) [### Bulletproof Hosting vs Offshore Hosting — What Is the Difference? Buying Bulletproof hosting and offshore hosting are constantly confused — and they are not the same thing. Here is the real difference, why it matters, and which one you actually want. 6-question FAQ](https://servhidden.com/guides/bulletproof-vs-offshore-hosting) [### How to Buy a VPS with Bitcoin — Step-by-Step (2026) Buying A beginner-friendly walkthrough of buying a VPS with Bitcoin: getting BTC, choosing a plan, paying the invoice, and what you get — a running server with no card and no name attached. 6-question FAQ](https://servhidden.com/guides/how-to-buy-a-vps-with-bitcoin) [### Best Countries for DMCA-Ignored Hosting in 2026 Buying Where to host when you want servers beyond the easy reach of US-style takedowns: the jurisdictions that work, what DMCA-ignored really means, and how to choose. 6-question FAQ](https://servhidden.com/guides/best-countries-for-dmca-ignored-hosting) [### How to Host a Tor Hidden Service (.onion Site) — 2026 Guide Operations Set up a Tor onion service on a VPS: what a hidden service is, why it is the strongest form of anonymous hosting, the full setup, and how to keep it actually anonymous. 6-question FAQ](https://servhidden.com/guides/how-to-host-a-tor-hidden-service) [### Offshore Mail Server Setup — Self-Host Private Email in 2026 Operations Run your own private email server on an offshore VPS: why self-host email, what you need, the realistic setup with an all-in-one mail stack, and how to get deliverability right. 6-question FAQ](https://servhidden.com/guides/offshore-mail-server-setup) [### Crypto Node Hosting Guide — Run a Blockchain Node on a VPS Operations How to host a blockchain node on a server: why run your own node, sizing the server for Bitcoin, Ethereum, Monero and more, the setup, and keeping it private. 6-question FAQ](https://servhidden.com/guides/crypto-node-hosting-guide) [### GPU Hosting for Stable Diffusion — Run Your Own Image Server Operations Run Stable Diffusion on your own GPU server: why self-host image generation, which GPU to pick, the setup with a web UI, and what it costs versus a hosted service. 6-question FAQ](https://servhidden.com/guides/gpu-hosting-for-stable-diffusion) [### Server OpSec — Staying Anonymous When You Run a Server Privacy Operational security for anyone running an anonymous server: the mistakes that deanonymise people, the habits that prevent them, and how to keep identities truly separate. 6-question FAQ](https://servhidden.com/guides/server-opsec-staying-anonymous) [### Seedbox Setup Guide — Build Your Own Private Seedbox in 2026 Operations How to build your own seedbox on a server: what a seedbox is, sizing it, installing a torrent client with a web UI, and keeping it private and secure. 6-question FAQ](https://servhidden.com/guides/seedbox-setup-guide) [### How to Bypass DPI Censorship with Your Own VPS (2026 Guide) Privacy Your VPN stopped working? How to bypass DPI censorship with your own VPS: what deep packet inspection actually detects, which of the five 2026 protocols beats which block, and a full VLESS+REALITY walkthrough. 6-question FAQ](https://servhidden.com/guides/bypass-dpi-censorship-with-your-own-vps) [### Full-Disk Encryption on a VPS: LUKS Setup and What It Really Protects Operations How to encrypt a VPS with LUKS: encrypted data volumes, full-root encryption with remote unlock over SSH, the settings that matter on a small server, and an honest account of what disk encryption stops. 8-question FAQ](https://servhidden.com/guides/full-disk-encryption-on-a-vps) [### VPS Backup Strategy: Encrypted, Off-Site and Actually Restorable Operations Your host keeps no backups. What really destroys servers, why push backups die with them, restic vs Borg, the keys everyone forgets, and how to test a restore. 8-question FAQ](https://servhidden.com/guides/vps-backup-strategy) [### Self-Hosting Matrix: Federation, Metadata and What E2EE Doesn’t Hide Operations What a Matrix homeserver really gives you: Synapse vs Conduit, the server_name you can never change, media that eats the disk, and what federation still reveals. 8-question FAQ](https://servhidden.com/guides/self-host-a-matrix-server) [### How to Migrate a Website to Offshore Hosting Without Downtime Operations The order that makes a host migration boring: lower the DNS TTL days ahead, run both servers in parallel, freeze writes for minutes rather than hours — and clean up the passive-DNS, Certificate Transparency and WHOIS trail the move leaves behind. 8-question FAQ](https://servhidden.com/guides/migrate-website-to-offshore-hosting) [### How to Self-Host a Crypto Payment Gateway with BTCPay Server Operations Run your own non-custodial checkout on an offshore VPS: BTCPay Server, a pruned Bitcoin node, Lightning and Monero — how to size the disk, why the private keys must never touch the machine, and where KYC quietly reappears at the cash-out. 8-question FAQ](https://servhidden.com/guides/self-host-a-crypto-payment-gateway) ## Put the right layer in front of the right server Network-level DDoS filtering and unmetered bandwidth on every plan, across seven offshore jurisdictions. Run a front node for a few dollars a month, keep the real work behind it — no KYC, crypto only. [View VPS Plans](https://servhidden.com/vps) [DMCA Ignored](https://servhidden.com/dmca-ignored-hosting) [Private Hosting](https://servhidden.com/anonymous-hosting) ## Structured data (JSON-LD) ```json { "@context": "https://schema.org", "@type": "Organization", "@id": "https://servhidden.com/#organization", "name": "ServHidden", "url": "https://servhidden.com", "description": "Offshore VPS & dedicated servers in 7 offshore jurisdictions. No KYC, no logs, crypto only. Privacy by architecture.", "logo": { "@type": "ImageObject", "url": "https://servhidden.com/ServHidden.webp", "width": 512, "height": 512 }, "foundingDate": "2025", "areaServed": [ { "@type": "Country", "name": "Iceland" }, { "@type": "Country", "name": "Panama" }, { "@type": "Country", "name": "Moldova" }, { "@type": "Country", "name": "Romania" }, { "@type": "Country", "name": "Switzerland" }, { "@type": "Country", "name": "Netherlands" }, { "@type": "Country", "name": "Russia" } ], "knowsAbout": [ "Offshore hosting", "Offshore VPS", "Bare-metal dedicated servers", "DMCA-ignored hosting", "No KYC hosting", "Cryptocurrency payments", "Privacy engineering", "Token-based authentication", "Anonymous domain name registration", "No-KYC domain registrar", "WHOIS privacy", "Cheap .com domains", "Crypto-paid domain names", "NVIDIA GPU compute", "Windows RDP hosting", "Agentic commerce" ], "contactPoint": { "@type": "ContactPoint", "contactType": "customer support", "url": "https://servhidden.com/contact", "availableLanguage": [ "en", "ru", "zh", "es", "fr", "de", "pt", "ar", "ja", "ko", "hi", "id", "it", "tr", "fa", "vi" ] }, "sameAs": [ "https://servhidden.com/canary", "https://servhidden.com/press" ] } ``` ```json { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://servhidden.com/#website", "url": "https://servhidden.com", "name": "ServHidden", "publisher": { "@id": "https://servhidden.com/#organization" }, "inLanguage": [ "en", "ru", "zh", "es", "fr", "de", "pt", "ar", "ja", "ko", "hi", "id", "it", "tr", "fa", "vi" ] } ``` ```json { "@context": "https://schema.org", "@type": "Article", "headline": "Hiding Your Origin Server IP: CDNs, Reverse Proxies and What Still Leaks", "description": "Whether to put a CDN in front of an offshore server: what it hides, the abuse desk you inherit, the six ways an origin IP leaks anyway, and how to audit yours.", "image": "https://servhidden.com/assets/img/guides/hiding-your-origin-server-ip.webp?v=1787175673", "author": { "@type": "Organization", "@id": "https://servhidden.com/#editorial", "name": "ServHidden Editorial", "url": "https://servhidden.com/about", "description": "Operator-side editorial team writing about offshore hosting jurisdictions, offshore server architecture, self-hosted privacy stacks and crypto payments.", "knowsAbout": [ "Offshore hosting jurisdictions", "Data retention law", "MLAT and judicial cooperation", "WireGuard and OpenVPN deployment", "Tor relay operation", "Monero and Bitcoin payment privacy", "KVM virtualization and bare-metal hosting", "DMCA-ignored hosting" ], "parentOrganization": { "@id": "https://servhidden.com/#organization" } }, "publisher": { "@id": "https://servhidden.com/#organization" }, "datePublished": "2026-08-19T00:00:00+00:00", "dateModified": "2026-08-19T00:00:00+00:00", "mainEntityOfPage": "https://servhidden.com/guides/hiding-your-origin-server-ip", "inLanguage": "en", "keywords": "hide origin server IP, origin IP leak, Cloudflare offshore hosting, DDoS protection offshore VPS, reverse proxy hide origin, L7 DDoS mitigation, certificate transparency origin leak, lock origin to CDN IP ranges", "articleSection": "Privacy", "wordCount": 2988 } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does a CDN hide my server's real IP address?", "acceptedAnswer": { "@type": "Answer", "text": "It hides it from clients, which is most of the benefit: visitors connect to the CDN and never see your address. It does not hide it from public records that already exist, from anything your server sends outward, or from internet-wide scanners that can match your origin by its certificate or its homepage. And it only works if your firewall stops the origin answering anyone other than the CDN — otherwise the address is one confirmed request away from being useful again." } }, { "@type": "Question", "name": "Does putting Cloudflare or another CDN in front undo DMCA-ignored hosting?", "acceptedAnswer": { "@type": "Answer", "text": "In practice, yes. A CDN is a party to your service and has its own abuse process: notices can be filed against it directly, and it will typically forward them to you, identify your hosting provider, or drop you as a customer. That reconnects the takedown chain that offshore hosting is chosen to break. For content that attracts complaints, the better arrangement is direct hosting in a jurisdiction picked on purpose, with the network-level DDoS filtering that already comes with the server." } }, { "@type": "Question", "name": "Is layer 3/4 DDoS protection enough on its own?", "acceptedAnswer": { "@type": "Answer", "text": "For volumetric attacks — the kind that fill your uplink — yes, and it is the only layer that can help there, because it works before the traffic reaches you. It is included on every plan with unmetered bandwidth, so an attack does not produce a bill either. What it cannot address is a layer-7 flood of well-formed requests. If a single request to your application can trigger a database scan or an image resize, that is where your risk is, and caching, rate limiting and a WAF are the answer rather than packet filtering." } }, { "@type": "Question", "name": "How do people find the origin IP behind a CDN?", "acceptedAnswer": { "@type": "Answer", "text": "Six routes account for nearly all of it: Certificate Transparency logs revealing subdomains that are not proxied, passive-DNS archives holding the address the domain used before the move, records that cannot be proxied such as mail exchangers, outbound connections from the server itself including its own email headers, internet-wide scanning that matches the origin by certificate or page content, and the application leaking its own address through redirects, status endpoints or a default virtual host. None of them requires any skill." } }, { "@type": "Question", "name": "Can I use a CDN and stay anonymous?", "acceptedAnswer": { "@type": "Answer", "text": "Only if the account is as anonymous as the server, which is rarely the case. A CDN account carries an email address, a payment method and often a phone number, tied to your domain and retained indefinitely by a company that responds to legal process. If you paid for the server in Monero without identity documents and then opened a CDN account with a personal card, the account is now the strongest identity record in the arrangement. Either keep the front under your own control, or make the account as disposable as everything else." } }, { "@type": "Question", "name": "Do I need any of this for a small site?", "acceptedAnswer": { "@type": "Answer", "text": "Usually not. A small site on a server with network-level filtering, a default-deny firewall and no services it does not need is a perfectly ordinary and reasonably robust arrangement. The origin question becomes real when there is a specific reason to hide the machine — an audience that includes people who would attack it, a backend worth more than the front, or content whose hosting arrangement you would rather not advertise." } }, { "@type": "Question", "name": "Should the mail server run on the same IP as the website?", "acceptedAnswer": { "@type": "Answer", "text": "No, and this is one of the most common ways an origin is exposed. Mail has to be reachable at an address that cannot be proxied, and every message it sends carries that address in its headers. Running mail on a separate machine keeps the web origin out of every email you send and out of the DNS records anyone can query. It also keeps a mail reputation problem from becoming a website problem." } }, { "@type": "Question", "name": "My origin IP has already leaked — what now?", "acceptedAnswer": { "@type": "Answer", "text": "Treat the address as permanently public, because passive-DNS and scan archives keep it. Close the leak first, whether that is an unproxied record, an email path or a default virtual host, then move to a new address and cut over with a short DNS TTL prepared in advance. Do not leave the old server answering on the old address with the same content. Since nothing about the original server was tied to an identity, replacing it is an ordinary deployment rather than a negotiation with anyone." } } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://servhidden.com/" }, { "@type": "ListItem", "position": 2, "name": "Privacy Hosting Guides", "item": "https://servhidden.com/guides" }, { "@type": "ListItem", "position": 3, "name": "Hiding Your Origin Server IP: CDNs, Reverse Proxies and What Still Leaks", "item": "https://servhidden.com/guides/hiding-your-origin-server-ip" } ] } ```