best-cf-ips turns Cloudflare IP hunting into a three-hour subscription

The address behind your node is a variable

A Cloudflare-based proxy node inherits its quality from one unglamorous choice: which Cloudflare address your client dials. The network is anycast, so different addresses land on different edges with different latency and stability, and the README assumes you already know this much. best-cf-ips exists to take that choice out of your hands on a schedule: it publishes text lists of tested IPv4 endpoints, exposed as raw GitHub URLs that any subscription-aware tool can consume.

The project description frames it plainly: quality IPs make quality nodes. The maintenance model is a feed, not a release; the last push was on 2026-09-17, and the files themselves regenerate every three hours.

Anatomy of the feed files

Two families live in the repository, and they are not interchangeable. The collected file, best-cf-ip-collected.txt, aggregates several public preferred-IP sources, Cmliu, WeTest, UOUIN, IPDB and VPS789 are credited, then deduplicates and appends country-region tags and flags. The scanned files are the project's own latency measurements, sorted and sliced into nested tiers: top20 inside top50 inside top100 inside top200 inside top400.

Each line reads as address, port, then a country marker, with ports drawn from Cloudflare's TLS range; the README's illustration shows 443, 8443 and 2053. The first line of every file carries the collection timestamp, one sample reads # 91 best ips collected at 2026-09-11 00:42, which is the honest way to check freshness. The README's own advice on sizing: pick one tier, since stacking tiers duplicates addresses.

Hooking the lists into edgetunnel and Mihomo

The documented consumer is Cmliu/edgetunnel's custom subscription aggregation, which converts the list into proxy nodes. The two canonical endpoints:

https://raw.githubusercontent.com/LancelotRar/best-cf-ips/main/best-cf-ip-collected.txt
https://raw.githubusercontent.com/LancelotRar/best-cf-ips/main/best-cf-ip-scanned-top50.txt

Swap the tier suffix for top20, top100, top200 or top400 as needed. Once converted, Mihomo-style clients display each node with its country code and flag, which opens the actual workflow: group nodes by region into policy groups and run url-test inside a single region, so the address can rotate without the region jumping.

The README motivates this with a concrete failure: a Telegram account in its early period can trigger risk controls when its exit IP changes regions too often. The author's free-subs repository ships a Mihomo template, liqun_example.yaml, with region groups preset and DNS-leak prevention, explicitly a template to fork rather than a subscription.

A changelog that broke every bookmark

The top of the README is a caution box, and it earns its place. On 2026-09-05 the preferred-domain API moved out of this repository into a new one, best-cf-domains. On 2026-09-11 the filenames changed: the aggregate became best-cf-ip-collected.txt and the scanned files became best-cf-ip-scanned-top20.txt through top400. Every link copied before those dates points at a dead path.

Treat that as the operating manual for this kind of feed. Subscriptions are URLs, URLs are promises, and this project has shown twice in one week that it will break them in exchange for better naming. The first-line timestamp doubles as the diagnostic: if your tool shows an old collection date, you are on a stale link, not a stalled scanner.

Honest limits: IPv4, fuzzy geography, no licence

Three constraints bound the project. The scope is IPv4 only, stated in its own title, so IPv6-only setups get nothing. Country tags are best effort: the README links an issue comment on Cloudflare's anycast mechanism and warns that different carriers can resolve the same address to different regions, so a tag is a hint, not a guarantee of where your traffic exits.

Governance is the third gap. There is no licence file, so formal reuse terms do not exist, and the data itself is aggregated from other people's public feeds. The README also carries referral registration links for LLM relay services, unrelated to the IP data but worth knowing about if you are evaluating the project's incentives. None of this breaks the core use, subscribing and reading the files, but all of it matters if you planned to build a service on top.

Direct feeds or your own scanner

Two alternatives bracket the subscription. Going direct means consuming the credited sources yourself: Cmliu's feed at cf.090227.xyz, WeTest, UOUIN, IPDB, VPS789. You get each source's freshest data and lose the deduplication, the country tagging and the tiered sizing that make best-cf-ips convenient.

Going self-hosted means running your own scanner on a schedule, the approach the README's linked video tutorials demonstrate alongside these feeds. You own the methodology and the freshness, and you also own the upkeep, the monitoring and the failure modes that this project currently absorbs. The subscription sits in the middle: it is the right default until its renames or its cadence stop matching how you operate, and at that point the migration path to either side is short.

Editorial conclusion

best-cf-ips earns its place if you run edgetunnel-style nodes and want region-tagged addresses without operating a scanner; start with top20 or top50 and expand only if your client actually rotates through them. Look elsewhere if you need IPv6, if an unlicensed aggregated feed is unacceptable for your use, or if you cannot tolerate link renames. Do one thing before subscribing: copy the URLs from the README today, note the timestamp convention, and check the first line of your first fetch, because that line is the only freshness contract the project offers.

Frequently asked questions

Official sources

1. Issues
2. LancelotRar/best-cf-ips on GitHub
3. Project website
4. README