4 ms·

They always forward those abuse reports onto the original hosting provider. What more can they do? They're not really obligated to do anything other than that.

by rudolf0 11y ago

dsl 11y ago
When you are proxying web traffic to an obvious phishing site, you could... you know... stop?
- jgrahamc 11y ago
  And we do. Tell us about phishing here: https://www.cloudflare.com/abuse/ https://www.cloudflare.com/abuse/
  - deleted 11y ago
    [deleted]
  - yoo1I 11y ago
    Let me preface this thusly: I understand you are a reverse proxy. Do not try and explain this to me again. I've heard it so many times by now, when it really wasn't necessary for you to explain it to me again - or on the first place. Really I understand. Furthermore, as per your FAQ[0] regarding phishing, you do NOT intend to actually stop proxying, you intend to MITM the website and insert some sort of warning. But to come back to the original complaint: In addition to being a reverse proxy, you also run nameservers. I do not care why and how you do that. Fact is you do. These your nameservers are authorative ( as in 'dig -t ns example.com') for domains that are exclusively used for scam websites which you DO NOT HOST OR PROXY. You just provide DNS. Is there _any_ way you would consider stopping to do that ? Please don't ask me to go through your support channels again. I've tried. They didn't manage to understand the problem or didn't manage to make it clear that they have. [0] https://support.cloudflare.com/hc/en-us/articles/200167736-How-do-I-file-a-phishing-complaint- https://support.cloudflare.com/hc/en-us/articles/200167736-H...
    - ChristianBundy 11y ago
      Please forgive me for playing devil's advocate, but I can't resist the urge to jump in here -- why should they provide you with a free (!) consumer security solution? It sounds like they were trying to give you a hint by telling you that they're a reverse proxy, but I'll put it very clearly: they are a reverse proxy for paying customers, not a consumer security solution for the general public. They offer a domain name management service, not a DNS security service. Complaining to CloudFlare that they're not offering you a free security service would be like complaining to OpenDNS that they're not offering a domain name management service. You wouldn't repeatedly harass Dun & Bradstreet and complain that they don't provide you with a free (!!!) consumer credit report, why do you feel so entitled to do the same to CloudFlare? Unless you've entered a consumer security contract with CloudFlare that I'm unaware of (which is totally possible), I'm afraid that you might just be feeling entitled.
      - yoo1I 11y ago
        "Consumer Security Solution"? Your advocating is pretty devilish indeed I think you are misunderstanding what's going on and it seems you are not aware that dealing with network resource abuse is a normal thing in the running of an internet service - at any level. There are many legitimate uses of network resources and some which aren't: spamming, hosting illegal content (for whatever value of illegal), running botnets and so on. Each organization and jurisdiction sets their own rules about what is and isn't allowed on their resources which their customers have to abide by. And usually they share a way to report abuses to them. (See, the companies who hosted the spammers who sent out the link to the domains in question have already responded by shutting the spambots down.) And indeed CloudFlare does have these policies in place, which you can clearly read on the link shared by jgrahamc above. This particular issue is concerning a situation which isn't directly addressed by the rules already in place, and I am well within my rights to ask them to remedy this. And if I was aware that customers of Dun & Bradstreet were selling data they received by Dun & Bradstreet on the black market to the Yakuza, be sure that I would let them know about it repeatedly. You keep emphasizing that I want something for free from them, au contraire, I am providing them with a free service by letting them know they're system is being used by criminals to commit crimes.

They always forward those abuse reports onto the original hosting provider. What more can they do? They're not really obligated to do anything other than that.

by rudolf0 11y ago

They always forward those abuse reports onto the original hosting provider. What more can they do? They're not really obligated to do anything other than that.

dsl 11y ago

When you are proxying web traffic to an obvious phishing site, you could... you know... stop?

jgrahamc 11y ago
And we do. Tell us about phishing here: https://www.cloudflare.com/abuse/ https://www.cloudflare.com/abuse/
- deleted 11y ago
  [deleted]
- yoo1I 11y ago
  Let me preface this thusly: I understand you are a reverse proxy. Do not try and explain this to me again. I've heard it so many times by now, when it really wasn't necessary for you to explain it to me again - or on the first place. Really I understand. Furthermore, as per your FAQ[0] regarding phishing, you do NOT intend to actually stop proxying, you intend to MITM the website and insert some sort of warning. But to come back to the original complaint: In addition to being a reverse proxy, you also run nameservers. I do not care why and how you do that. Fact is you do. These your nameservers are authorative ( as in 'dig -t ns example.com') for domains that are exclusively used for scam websites which you DO NOT HOST OR PROXY. You just provide DNS. Is there _any_ way you would consider stopping to do that ? Please don't ask me to go through your support channels again. I've tried. They didn't manage to understand the problem or didn't manage to make it clear that they have. [0] https://support.cloudflare.com/hc/en-us/articles/200167736-How-do-I-file-a-phishing-complaint- https://support.cloudflare.com/hc/en-us/articles/200167736-H...
  - ChristianBundy 11y ago
    Please forgive me for playing devil's advocate, but I can't resist the urge to jump in here -- why should they provide you with a free (!) consumer security solution? It sounds like they were trying to give you a hint by telling you that they're a reverse proxy, but I'll put it very clearly: they are a reverse proxy for paying customers, not a consumer security solution for the general public. They offer a domain name management service, not a DNS security service. Complaining to CloudFlare that they're not offering you a free security service would be like complaining to OpenDNS that they're not offering a domain name management service. You wouldn't repeatedly harass Dun & Bradstreet and complain that they don't provide you with a free (!!!) consumer credit report, why do you feel so entitled to do the same to CloudFlare? Unless you've entered a consumer security contract with CloudFlare that I'm unaware of (which is totally possible), I'm afraid that you might just be feeling entitled.
    - yoo1I 11y ago
      "Consumer Security Solution"? Your advocating is pretty devilish indeed I think you are misunderstanding what's going on and it seems you are not aware that dealing with network resource abuse is a normal thing in the running of an internet service - at any level. There are many legitimate uses of network resources and some which aren't: spamming, hosting illegal content (for whatever value of illegal), running botnets and so on. Each organization and jurisdiction sets their own rules about what is and isn't allowed on their resources which their customers have to abide by. And usually they share a way to report abuses to them. (See, the companies who hosted the spammers who sent out the link to the domains in question have already responded by shutting the spambots down.) And indeed CloudFlare does have these policies in place, which you can clearly read on the link shared by jgrahamc above. This particular issue is concerning a situation which isn't directly addressed by the rules already in place, and I am well within my rights to ask them to remedy this. And if I was aware that customers of Dun & Bradstreet were selling data they received by Dun & Bradstreet on the black market to the Yakuza, be sure that I would let them know about it repeatedly. You keep emphasizing that I want something for free from them, au contraire, I am providing them with a free service by letting them know they're system is being used by criminals to commit crimes.