5 ms·

Dear CloudFlare, now that you're a registrar, will you respond to abuse reports about scammers' domains being resolved by your DNS servers by at least showing

by yoo1I 11y ago

Dear CloudFlare, now that you're a registrar, will you respond to abuse reports about scammers' domains being resolved by your DNS servers by at least showing that you've understood the problem instead of a generic "We R a ReverseProxy Company, u no?". I know that; I've said so in my abuse report. That wasn't the problem. Really frustratedly yours, yoo1I

Dylan16807 11y ago
Resolving a scammer domain is just telling you a fact. What abuse is there at the DNS level?
- lstamour 11y ago
  Scammers are scammers? What's next? Hosting DNS for botnets?
  - Dylan16807 11y ago
    Wouldn't that make them easier to track? Refusal to sell a domain to a scammer can help the world. Refusing to resolve a domain is kind of pointless, and I want a DNS server to tell me the truth.
    - yoo1I 11y ago
      See the problem is getting at the actual perpetrators. You are surely correct, the further down the line they can be stopped the better. But due to they way these scammers operate it becomes difficult to impossible to reach them. One action that increases the cost of criminal organizations is then to deny them usage of resources of legitimate companies. All these usually have an AUP which prohibits certain activities. And I am with you, a DNS resolver should tell the truth. What I am asking CloudFlare to do, is to not accept certain customers in the first place, so that they don't get to use the CloudFlare authorative DNS servers. Obviously this works best if hosting providers do the same thing.
    - lstamour 11y ago
      Actually I hear DNS is often used with cloud APIs as a way to have botnets and trojans contact the mothership for things like instructions or wiring payment to decrypt drives, etc. It used to be they were at the same domain names, but folks got wise and started banning domains, so now they use domain name "trials" and random domain names to resolve to changing IP addresses at scheduled intervals. Or at least that's how I remember hearing it described. So DNS is as critical to botnets/bad guys as anything else is online. Also, since registries are global, all it takes is one country refusing to follow the rest of the world in trying to block spammers from registering domains, and DNS resolution becomes part of the solution. Of course they could go elsewhere but at least CloudFlare wouldn't be part of the problem.
rudolf0 11y ago
They always forward those abuse reports onto the original hosting provider. What more can they do? They're not really obligated to do anything other than that.
- dsl 11y ago
  When you are proxying web traffic to an obvious phishing site, you could... you know... stop?
  - jgrahamc 11y ago
    And we do. Tell us about phishing here: https://www.cloudflare.com/abuse/ https://www.cloudflare.com/abuse/
    - deleted 11y ago
      [deleted]
    - yoo1I 11y ago
      Let me preface this thusly: I understand you are a reverse proxy. Do not try and explain this to me again. I've heard it so many times by now, when it really wasn't necessary for you to explain it to me again - or on the first place. Really I understand. Furthermore, as per your FAQ[0] regarding phishing, you do NOT intend to actually stop proxying, you intend to MITM the website and insert some sort of warning. But to come back to the original complaint: In addition to being a reverse proxy, you also run nameservers. I do not care why and how you do that. Fact is you do. These your nameservers are authorative ( as in 'dig -t ns example.com') for domains that are exclusively used for scam websites which you DO NOT HOST OR PROXY. You just provide DNS. Is there _any_ way you would consider stopping to do that ? Please don't ask me to go through your support channels again. I've tried. They didn't manage to understand the problem or didn't manage to make it clear that they have. [0] https://support.cloudflare.com/hc/en-us/articles/200167736-How-do-I-file-a-phishing-complaint- https://support.cloudflare.com/hc/en-us/articles/200167736-H...
      - 11y ago

by yoo1I 11y ago

Dylan16807 11y ago

Resolving a scammer domain is just telling you a fact. What abuse is there at the DNS level?

lstamour 11y ago
Scammers are scammers? What's next? Hosting DNS for botnets?
- Dylan16807 11y ago
  Wouldn't that make them easier to track? Refusal to sell a domain to a scammer can help the world. Refusing to resolve a domain is kind of pointless, and I want a DNS server to tell me the truth.
  - yoo1I 11y ago
    See the problem is getting at the actual perpetrators. You are surely correct, the further down the line they can be stopped the better. But due to they way these scammers operate it becomes difficult to impossible to reach them. One action that increases the cost of criminal organizations is then to deny them usage of resources of legitimate companies. All these usually have an AUP which prohibits certain activities. And I am with you, a DNS resolver should tell the truth. What I am asking CloudFlare to do, is to not accept certain customers in the first place, so that they don't get to use the CloudFlare authorative DNS servers. Obviously this works best if hosting providers do the same thing.
  - lstamour 11y ago
    Actually I hear DNS is often used with cloud APIs as a way to have botnets and trojans contact the mothership for things like instructions or wiring payment to decrypt drives, etc. It used to be they were at the same domain names, but folks got wise and started banning domains, so now they use domain name "trials" and random domain names to resolve to changing IP addresses at scheduled intervals. Or at least that's how I remember hearing it described. So DNS is as critical to botnets/bad guys as anything else is online. Also, since registries are global, all it takes is one country refusing to follow the rest of the world in trying to block spammers from registering domains, and DNS resolution becomes part of the solution. Of course they could go elsewhere but at least CloudFlare wouldn't be part of the problem.

rudolf0 11y ago

They always forward those abuse reports onto the original hosting provider. What more can they do? They're not really obligated to do anything other than that.

dsl 11y ago
When you are proxying web traffic to an obvious phishing site, you could... you know... stop?
- jgrahamc 11y ago
  And we do. Tell us about phishing here: https://www.cloudflare.com/abuse/ https://www.cloudflare.com/abuse/
  - deleted 11y ago
    [deleted]
  - yoo1I 11y ago
    Let me preface this thusly: I understand you are a reverse proxy. Do not try and explain this to me again. I've heard it so many times by now, when it really wasn't necessary for you to explain it to me again - or on the first place. Really I understand. Furthermore, as per your FAQ[0] regarding phishing, you do NOT intend to actually stop proxying, you intend to MITM the website and insert some sort of warning. But to come back to the original complaint: In addition to being a reverse proxy, you also run nameservers. I do not care why and how you do that. Fact is you do. These your nameservers are authorative ( as in 'dig -t ns example.com') for domains that are exclusively used for scam websites which you DO NOT HOST OR PROXY. You just provide DNS. Is there _any_ way you would consider stopping to do that ? Please don't ask me to go through your support channels again. I've tried. They didn't manage to understand the problem or didn't manage to make it clear that they have. [0] https://support.cloudflare.com/hc/en-us/articles/200167736-How-do-I-file-a-phishing-complaint- https://support.cloudflare.com/hc/en-us/articles/200167736-H...
    - 11y ago