# CloudFlareScan: measuring which Cloudflare edge addresses answer fastest

> CloudFlareScan, or CFS, generates candidate addresses from Cloudflare's published IP ranges and measures them so that a user can find the ones with the lowest latency from their own network, over both IPv4 and IPv6. It ships as a single Python script with prebuilt binaries for four platforms, and the repository is small enough to read in one sitting.

**xiaolin-007/CloudFlareScan** — CloudFlare Scan    CF本地优选IP扫描测速软件(ipv4&ipv6) 适配 Win macOS Android Linux

- Repository: https://github.com/xiaolin-007/CloudFlareScan
- Stars: 921 · Forks: 281
- Language: Python
- License: MIT
- Published: 2026-10-20 · Updated: 2026-10-20 · Language: en
- Canonical page: https://hysenlabs.com/projects/xiaolin-007-cloudflarescan

## The problem is that the nearest Cloudflare address is not always the fastest

The project is described in Chinese as a local preferred-IP scanning and speed test tool for Cloudflare, adapting to Windows, macOS, Android and Linux, and it is known as CFS. The idea behind a tool like this is straightforward. Cloudflare publishes its address ranges, anycast means those addresses are served from many locations, and a given client is normally routed to whichever of those locations the network operator's peering arrangement points at. That location is not always the one with the shortest path from the client, and when it is not, the difference is visible as latency on every request.

The documentation lists its features as a set of six claims, and reading them tells you what the tool actually does.

The first is efficient scanning, described as automatically generating IP addresses from Cloudflare's official IP segments. So the candidate set comes from the published ranges rather than from a hardcoded list, and the tool does the enumeration for you rather than asking you to supply a range to scan.

The second is dual mode speed testing, described as a full speed test plus a regional speed test, to meet different needs. A full scan tells you which addresses anywhere in the ranges respond quickly. A regional scan restricts the candidates to one part of the world.

The third is global coverage, described as a built-in mapping for most airport IATA codes worldwide with automatic region detection. That is the mechanism behind the regional mode, and it is also what makes the result interpretable, because an address that responds in 20 milliseconds is only useful if you know which data centre it is.

The remaining three are about the application rather than the measurement: asynchronous processing with high concurrency support for fast results, one-click copying by double-clicking a table cell, and real-time statistics showing scan progress and speed.

## Region detection by IATA code is the part that makes results usable

It is worth spending a paragraph on the regional mode, because it is the feature that separates this from a generic ping sweep.

A latency number on its own is close to useless when you have a list of hundreds of addresses. Twenty milliseconds means nothing until you know it is a nearby data centre rather than one on another continent. The tool embeds a mapping of most airport IATA codes worldwide and uses it to identify the region of a responding address automatically.

That is a design decision with a consequence. Instead of reporting a list of addresses sorted by response time, it can report which regions are reachable and how quickly, and a user can then pick an address whose region suits them. For a tool whose purpose is finding a better route to a specific anycast service, that is the difference between a measurement and a result.

The asynchronous processing claim is the other half of the design. A scan over generated addresses in Cloudflare's ranges is a large number of probes, and a tool that issued them one at a time would take a very long time. High concurrency is what makes the enumeration practical, and the real-time progress and speed display is there so the user can see it is working rather than assume it has hung.

The one-click copying is small but telling. The results are in a table, and double-clicking a cell copies its content, which means the output can be pasted straight into whatever configuration a user needs to change. The tool is designed for a person at a terminal or on a phone, working through a list, not for feeding a pipeline.

## Four platforms, four different installation stories

The usage section of the documentation is short and each platform gets a different treatment.

For Windows on x64 the instruction is to download and use it directly. For Android, download and install. For macOS on Apple Silicon, there is a caveat: the app needs to be allowed in the privacy and security settings, and the documentation gives the terminal command to use:

```bash
sascript -e 'do shell script "sudo spctl --master-disable" with administrator privileges'
```

That command disables the Gatekeeper master switch system-wide, with administrator privileges. It works, and it is a blunt instrument: it turns off a protection for the whole machine rather than for this one application. The documentation's own phrasing for macOS is that you need to allow the app from any source, and it is a reasonable request for a developer who has just downloaded a binary from a GitHub release, but the safe version of the same thing is to allow that specific application, and the reason the tool cannot be signed is not something the documentation explains.

Linux is the one platform with an ordinary Unix installation, and it is where the tool's origin as a Python script shows:

```bash
chmod +x CloudFlareScan
./CloudFlareScan
```

The instruction is to extract the archive and then make the file executable and run it. There is no package manager entry, no install script and no virtual environment step in the documentation, which is consistent with the top level repository listing, which contains exactly three entries: CloudFlareScan.py, LICENSE and README.md.

The disclaimer at the top of the documentation is worth quoting in substance: this tool is for study and legal network speed testing, please obey local laws and regulations, and you are responsible for the consequences. That is the correct framing for a tool that sends probes to addresses belonging to someone else.

## A Python script that also ships as a Go rewrite

The release history contains a detail that does not fit the rest of the repository listing.

The releases are V4.1 on 2026-08-26, described as covering X86, macOS, Linux and Android, V4.01 on 2026-08-24, described as the Go version redesign, and V4.0 on 2026-05-16, described as covering X86 Windows, macOS and Android. So the project went through a version 4 line, then produced a Go rewrite, then a 4.1.

The Go rewrite is the interesting decision. The original was a single Python script, and the reason a tool like this works on a phone and on a router-adjacent Linux box is often that it has no runtime to install. Python needs an interpreter, and on an embedded or minimal system that is a real barrier. A Go rewrite produces a single static binary, which is exactly what the multi-platform release naming suggests, with separate archives per platform.

The complication is that the repository listing on the main branch still shows CloudFlareScan.py as the only source file, alongside the licence and the readme. There is no Go directory, no go.mod, and no build script in the listing. So either the Go implementation lives elsewhere, or it lives in a branch that the listing does not cover, and the documentation does not say which.

That matters for anyone who wants to read the code rather than run the binary, and it matters for anyone building on it. The project metadata lists the primary language as Python, which reflects what is on the main branch, and the topics list includes only generic terms such as cloudflare, ip, ipv4, ipv6 and scan, with no topic that would tell you a Go implementation is expected.

## Where a local latency scanner is the wrong tool

Three boundaries are worth naming.

The first is that it only measures from where you are. The whole method is a client probing addresses over its own network connection, so the results describe your route, at that moment, on that ISP. A user in one city cannot use the tool to find the best address for a user in another. There is no distributed probing, no vantage point selection, and no option in the documented feature list for running the measurement from elsewhere. If you need a view of Cloudflare's edge from a range of locations, this is the wrong tool, and the answer is a measurement service that does distributed probing rather than a local scanner.

The second is the scope of what can be scanned. The candidate set is generated from Cloudflare's published IP ranges, so it is by construction limited to Cloudflare addresses. There is no way to point it at another network's prefix, and the documentation does not describe a mode for supplying your own range. For a general latency scanner across any address space, a different tool is the answer.

The third is the legal and practical posture. The tool sends a large number of probes to addresses it does not own, from a machine that is often a home connection, and the project's own disclaimer limits its intended use to study and legal network speed testing with the user bearing the consequences. That is not an objection to the tool, it is a condition on using it, and a user in a network where unsolicited probing is unwelcome or where a provider objects should not run it.

There is also the simpler observation that a single Python script with no test suite, no documentation beyond a feature list and no configuration is something you would normally read before running, not adopt as a dependency. It is a utility, and the appropriate expectation is that you use it and then discard it.

## What the maintenance record says

The project is MIT licensed, with a licence file in the repository, and it is not archived. The last push to the repository was on 2026-10-19, and the recent releases are dated 2026-08-26, 2026-08-24 and 2026-05-16, so the code is being worked on and the release cadence in the v4 line is roughly monthly.

The state of the repository is a more useful signal than the release numbers, though. Three files, one of which is the script, is a project that expects to be read rather than extended. There is no issue tracker mentioned in the documentation, no contributing guide, no changelog, and no test suite in the listing. The README is the entire documentation, and it is written in Chinese with a feature list and platform install notes rather than with usage guidance for the command line options.

The demonstration video is linked, hosted on YouTube, and the repository is under a personal account rather than an organisation.

None of that makes it a bad utility. For the job it does, a self contained script that enumerates Cloudflare ranges, measures latency and shows a table is a reasonable thing to publish and a reasonable thing to grab and run. But it also means you should expect to read the source and adapt it yourself rather than expect a maintained library with a support path, and it means the README's silence on things like the command line flags, the output format, the concurrency limit and the timeout behaviour is a genuine gap rather than a summary choice.

The MIT licence is at least unambiguous and requires no obligations on a user beyond keeping the notice, which for a script you read and adapt is exactly what you want.

## Conclusion

CloudFlareScan fits someone on a network where the default Cloudflare routing is not the fastest route to it, who wants to measure rather than guess, and who can run a script locally to test addresses from their own line. It is the wrong tool if you need to scan anything other than Cloudflare addresses, if you want results from other vantage points rather than your own connection, or if you need a documented API instead of a table on screen. Before adopting it, read the disclaimer the project puts at the top of the documentation, since the tool is presented for study and legal network speed testing only, and check the source file yourself, because the repository is a single script named CloudFlareScan.py plus a licence and a readme, and the releases also mention a Go rewrite that the top level listing does not show.

## FAQ

### What is CloudFlareScan and what does it do?

It is a Cloudflare IP scanning and speed test tool, known as CFS, that works on Windows, macOS, Android and Linux. It automatically generates IP addresses from Cloudflare's official IP segments, then tests them with support for high concurrency and shows scan progress, speed and results in a table.

### What are the two speed test modes in CloudFlareScan?

The documentation describes dual mode testing, a full speed test plus a regional speed test to meet different needs. The regional mode uses a built-in mapping of most airport IATA codes worldwide to identify the region of a responding address automatically.

### How do I run CloudFlareScan on Linux?

Extract the archive, then make the file executable and run it. The documented commands are chmod +x CloudFlareScan followed by ./CloudFlareScan.

### Why does macOS require a Gatekeeper change to run CloudFlareScan?

The documentation says the macOS Apple Silicon build needs to be allowed in the privacy and security settings, and gives the terminal command that disables the spctl master switch with administrator privileges. A safer alternative is to allow that specific application rather than the system-wide switch.

### Is CloudFlareScan still being maintained?

The repository is not archived and the last push was on 2026-10-19, with releases V4.1 on 2026-08-26, a Go rewrite on 2026-08-24 and V4.0 on 2026-05-16. The licence is MIT, and the repository contains CloudFlareScan.py, a licence file and a readme.

## Sources

- [Issues](https://github.com/xiaolin-007/CloudFlareScan/issues)
- [License: MIT](https://github.com/xiaolin-007/CloudFlareScan/blob/main/LICENSE)
- [README](https://github.com/xiaolin-007/CloudFlareScan/blob/main/README.md)
- [Releases](https://github.com/xiaolin-007/CloudFlareScan/releases)
- [xiaolin-007/CloudFlareScan on GitHub](https://github.com/xiaolin-007/CloudFlareScan)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/xiaolin-007-cloudflarescan