Team: Huntress Managed Identity Threat Detection and Response (ITDR)
Product: Unwanted Access Dashboard
Environment: iOS, Cloudflare WARP VPN, Apple iCloud Private Relay
Summary: Legitimate Apple device traffic is being identified as Cloudflare WARP VPN due to shared infrastructure between Cloudflare and Apple.
In this Article
What is Huntress Seeing?
Understanding the Issue
Mitigation Steps
Resolution
What is Huntress Seeing?
Huntress is investigating an increase in traffic originating from Apple’s iCloud Private Relay that is being identified as Cloudflare’s WARP VPN. Partners can verify the session with the end user and set an Expected status in their Unwanted Access dashboard and escalations to prevent further alerts.
Understanding the Issue
As of February 6, 2026, we have observed traffic originating from IP addresses registered to the Cloudflare WARP VPN service that appears to be functioning as part of Apple iCloud Private Relay.
Because Apple utilizes Cloudflare infrastructure for its backend, they occasionally lease additional IP capacity. There is often a delay before IP registration details are updated to reflect Apple’s ownership. Until that registration transition is complete, Huntress systems will continue to identify the traffic based on the current registrant (WARP VPN).
Mitigation Steps
If you receive an alert for WARP VPN that you suspect is legitimate Apple traffic, follow these steps:
Verify the session: Confirm with the end user whether iCloud Private Relay is enabled on their device.
Compare IP addresses: Verify that the reported IP address matches the relay address assigned to the user session.
Set an exclusion: If you confirm the traffic is legitimate, you can set an exclusion or Expected status for the WARP VPN classification within your Unwanted Access dashboard. Setting this status will prevent further alerts for these users while we wait for Apple to complete the IP registration updates.
Resolution
We are monitoring these ranges closely for registration updates to ensure our classifications remain as accurate as possible. This is a developing article and is subject to change as the Huntress team learns more.