15 ms·

We have a client that had someone make a direct copy of their website, same branding, same everything and put it on a domain running through Cloudflare. We've r

We have a client that had someone make a direct copy of their website, same branding, same everything and put it on a domain running through Cloudflare. We've reached out to Cloudflare to get them to take it down but nothing has been done. You also have a Cloudflare account to file a complaint, which I found to be odd. We're a Cloudflare customer too...but still that shouldn't be a hoop you have to jump through. Now there is this identical phishing site out there that Cloudflare reverse proxies and we can't see who registered the domain or who hosts the site (since Cloudflare masks the IPs.)

henhouse 5y ago
Cloudflare forwards DMCA copyright infringement complaints to the hosting provider, probably automatically to an abuse@ domain that it can detect. I’m not sure if they do the same for any other copyright claims, but they do pass it on to the parties that should be involved.
- adrr 5y ago
  But don't they store the copyrighted content on their servers? It's one thing just to be a transit mechanism it's another thing to store and serve copyrighted material like a hosting a provider.
  - dymk 5y ago
    Well, they don’t _not_ store it - their whole dealio is they cache website content on their servers. Not forever, but they’re not just a transit mechanism.
    - mintplant 5y ago
      They cache it across a geographically-distributed network of edge nodes, even. Potentially very hairy if this had gone south for them.
  - jedberg 5y ago
    If someone ships drugs through UPS, and it sits in a UPS warehouse for a few days, did UPS store drugs? Technically yes, but should they be liable for that?
    - stefan_ 5y ago
      If UPS finds drugs, they call the cops and you are probably better off not having that package delivered. If someone tells Cloudflare they are hosting copyright-infringing content.. they sue to say the Cloudflare service is ineffective and does nothing to provide the infringing content? Is this the analogy you were going for?
      - jedberg 5y ago
        Except UPS doesn't find drugs because they don't look for it. Just like Cloudflare doesn't look for illegal content. If someone told UPS a package has drugs in it, they'd say, "that's nice, talk to the sender" and then deliver the package. If someone tells Cloudflare, "that content is illegal", they say, "that's nice, talk to the site owner".
        vkou 5y ago
        > If someone told UPS a package has drugs in it, they'd say, "that's nice, talk to the sender" and then deliver the package. Would they? Or would they turn the package over to the police?
        scaryclam 5y ago
        Usually, people don't tell UPS they have a drugs package, they tell the police directly and the police go and work with UPS. That's the issue with many of these analogies, people don't talk to the car dealership/UPS/landlord/hotel staff/etc, they talk to the authorities because that's the normal thing to do.
    - asdff 5y ago
      In this case, it would be like if you told UPS someone is continuously shipping drugs through their system, and they said 'that's fine they are a paying customer' and continued to let them traffick with their infrastructure, rather than contact the police. At a certain point UPS is complicit and could be charged themselves even.
  - throw_m239339 5y ago
    > But don't they store the copyrighted content on their servers? IF they cache content, then they do store that content though, that's the whole idea behind caching.
- Matheus28 5y ago
  I have never seen these work. I've submitted a couple and they just go into a blackhole, never to hear from their hosting provider.
devwastaken 5y ago
Sue for copyright infringement, using discovery to compel the identity of the infringer, then continue to sue the infringer.
milankragujevic 5y ago
Regarding the IPs behind Cloudflare, when you send a DMCA notice to Cloudflare via email (meaning you don't need an account), Cloudflare will forward the notice to the host of the website, who will then take appropriate action. Cloudflare will usually also notify you about the origin IP of the website so you can further enforce your rights directly at the company which hosts the website.
brundolf 5y ago
Could that be treated as a trademark issue rather than a copyright issue?
akersten 5y ago
You (your client) can still subpoena Cloudflare for the customer's IP if you can get a court to agree that it's infringement and then go after the upstream host. That's seems like a solution compatible with this ruling, and an appropriate amount of lift.
- mmis1000 5y ago
  Some big parties always try to skip the court ruling and do whatever they want block the site without a law suit directly. Even the court ruling path exists there since forever and accomplish with the problem they claimed perfectly. Either because it is expensive or court obviously won't agree about every flawed claim they created. That isn't really a problem only in America. Some people in Taiwan also tries to pass similar law, end up get backfired when someone noticed it and stop the law creating process everytime. (And they still didn't give up )
- TheCoelacanth 5y ago
  Cloudflare, it seems, was perfectly willing to tell them identify of the customer without even going to court. > Cloudflare's security services do impact the ability of third parties to identify a website's hosting provider and the IP address of the server on which it resides. If Cloudflare's provision of these services made it more difficult for a third party to report incidents of infringement to the web host as part of an effort to get the underlying content taken down, perhaps it could be liable for contributory infringement. But here, the parties agree that Cloudflare informs complainants of the identity of the host in response to receiving a copyright complaint, in addition to forwarding the complaint along to the host provider.
ohazi 5y ago
This really doesn't seem like Cloudflare's problem. Did banks sue the Ford dealer for selling big V8 getaway cars to bank robbers? Or the city for operating the roads that they used to get away? Or the toll collector for letting the bank robbers cross a bridge after they paid the toll? No, because any of those things would have been ridiculous. At some point we as a society are going to have to get off this intellectual property high horse. Maybe we should stop trying to protect things that are easy to copy like website designs and wedding dresses. The enormous effort to try and protect these things damages society more than the benefit that even a successful outcome might have for a rights holder.
- matheusmoreira 5y ago
  > Maybe we should stop trying to protect things that are easy to copy like website designs and wedding dresses. Yeah. Copyright is nonsense in the 21st century where copying is trivial. It's holding us back.
  - afiori 5y ago
    actually copyright only make sense if copying is easy, were copying hard then there would need no need for copyrights.
    - matheusmoreira 5y ago
      Has copying ever been this easy though? In centuries past, if you wanted to infringe copyright at the same scale we do today, you'd need expensive stuff like printing presses and a viable business model that pays for the costs of running an industrial copying process. That's what made copyright enforceable: you'd need to be a major industry player in order to infringe copyright and such centralized operations are easy targets for litigation. Now everyone's got computers that can make and distribute a virtually unbounded amount of copies of anything to anyone within the network and there's pretty much nothing people can do about that.
- dymk 5y ago
  A Ford dealership would be liable for selling counterfeit Fords, or at least would be responsible for helping track down where that counterfeit came from.
Causality1 5y ago
What due process do you believe Cloudflare should implement with regards to claims that a particular site on their service deserves to be booted?
- markdown 5y ago
  DMCA?
  - RNCTX 5y ago
    Bad idea from top to bottom, glad someone outside of the Netherlands is ignoring it.
markdown 5y ago
> You also have a Cloudflare account to file a complaint, which I found to be odd. We're a Cloudflare customer too...but still that shouldn't be a hoop you have to jump through. I was once locked out of my Cloudflare account, and I couldn't contact them because to do so... required an account /* facepalm */ FYI, the way around this is to send an email to support@cloudflare.com. This isn't mentioned anywhere on the public-facing website. A truly bizarre way to treat paying customers.
jrochkind1 5y ago
> and we can't see who registered the domain or who hosts the site (since Cloudflare masks the IPs.) According to OP, it should be possible to get Cloudflare to tell you the originating IPs. I am not sure the mechanism though. From article: > But here, the parties agree that Cloudflare informs complainants of the identity of the host in response to receiving a copyright complaint, in addition to forwarding the complaint along to the host provider.
- xxdesmus 5y ago
  Not true -- according to the OP -- we'll tell you who the hosting provider is -- as in, the name and abuse email of the host. The origin IP is not needed.
  - jrochkind1 5y ago
    Ah true, I assumed from the quote. I would think the origin IP would be needed for the hosting provider to identify their customer though? And the judge seemed pretty sure that the complainant could effectiely take it up with the hosting provider... still, there are lots of opportunities for misunderstanding here in case to judge to article to us. Not sure exactly what cloudflare will give you!
    - xxdesmus 5y ago
      Cloudflare sends the origin IP directly to the hosting provider -- with a copy of the abuse report.
xxdesmus 5y ago
>> "You also have a Cloudflare account to file a complaint, which I found to be odd." That's incorrect. Anyone can fill out the web reporting form here: cloudflare.com/abuse -- absolutely no Cloudflare account needed.
derefr 5y ago
Cloudflare does take reports seriously when a site exists to phish logins from another site’s users (whether that site is a clone, or just claims to be representing the other party when it isn’t.) Especially when that other site has a credit card form. Sadly, the most they can really do (about their regular Cloudflare Proxy clients, at least) is reveal to you the unmasked hosting info of the origin site; at which point you’ve got to start another process for reporting a TOS violation to the origin’s hosting provider.
1vuio0pswjnm7 5y ago
Why not name the phishing website. There are some methods for discovering the IP address of the origin server hidden behind Cloudflare. No guarantees but IME, many origin IPs are easily discovered.
Abishek_Muthian 5y ago
> we can't see who registered the domain or who hosts the site (since Cloudflare masks the IPs.) TIL Cloudflare is also a registrar[1], Might be even the cheapest. I was wondering why the parent wasn't able to find who the site belonged to through just WHOIS and sending a abuse request to the registrar, Still Cloudflare should be forwarding the abuse report not sure what's the case here. Can anyone tell share their experience with Cloudflare registrar? When compared to something like Namecheap? Also can different Cloudflare accounts for separate products use same credit cards for using the registration service? [1] https://www.cloudflare.com/products/registrar/ https://www.cloudflare.com/products/registrar/
- fragmede 5y ago
  In particular, the cloudflare registrar forces you to use their nameservers, which is totally fine if you understand the ramifications going in.
  - Abishek_Muthian 5y ago
    That's a good point. I guess those who already have cloudflare nameservers wouldn't have an issue with it unless there are some issues with transferring the domain to cloudflare which already acts as your reverse proxy.
batch12 5y ago
Depending on the opsec of the group that stood the site up, this may still be possible to run down.
dragonwriter 5y ago
> We've reached out to Cloudflare to get them to take it down but nothing has been done. By “reached out”, I assume you don't mean “filed a DMCA takedown notice and, when they failed to take down the infringing material, filed a contributory copyright infringement lawsuit seeking both damages and a permanent injunction against Cloudflare making the infringing content available.” But I wonder why not? If there is a good reason not to, though, its probably also the reason that Cloudflare knows they can ignore you.

henhouse 5y ago

Cloudflare forwards DMCA copyright infringement complaints to the hosting provider, probably automatically to an abuse@ domain that it can detect. I’m not sure if they do the same for any other copyright claims, but they do pass it on to the parties that should be involved.

adrr 5y ago
But don't they store the copyrighted content on their servers? It's one thing just to be a transit mechanism it's another thing to store and serve copyrighted material like a hosting a provider.
- dymk 5y ago
  Well, they don’t _not_ store it - their whole dealio is they cache website content on their servers. Not forever, but they’re not just a transit mechanism.
  - mintplant 5y ago
    They cache it across a geographically-distributed network of edge nodes, even. Potentially very hairy if this had gone south for them.
- jedberg 5y ago
  If someone ships drugs through UPS, and it sits in a UPS warehouse for a few days, did UPS store drugs? Technically yes, but should they be liable for that?
  - stefan_ 5y ago
    If UPS finds drugs, they call the cops and you are probably better off not having that package delivered. If someone tells Cloudflare they are hosting copyright-infringing content.. they sue to say the Cloudflare service is ineffective and does nothing to provide the infringing content? Is this the analogy you were going for?
    - jedberg 5y ago
      Except UPS doesn't find drugs because they don't look for it. Just like Cloudflare doesn't look for illegal content. If someone told UPS a package has drugs in it, they'd say, "that's nice, talk to the sender" and then deliver the package. If someone tells Cloudflare, "that content is illegal", they say, "that's nice, talk to the site owner".
      - vkou 5y ago
        > If someone told UPS a package has drugs in it, they'd say, "that's nice, talk to the sender" and then deliver the package. Would they? Or would they turn the package over to the police?
        scaryclam 5y ago
        Usually, people don't tell UPS they have a drugs package, they tell the police directly and the police go and work with UPS. That's the issue with many of these analogies, people don't talk to the car dealership/UPS/landlord/hotel staff/etc, they talk to the authorities because that's the normal thing to do.
  - asdff 5y ago
    In this case, it would be like if you told UPS someone is continuously shipping drugs through their system, and they said 'that's fine they are a paying customer' and continued to let them traffick with their infrastructure, rather than contact the police. At a certain point UPS is complicit and could be charged themselves even.
- throw_m239339 5y ago
  > But don't they store the copyrighted content on their servers? IF they cache content, then they do store that content though, that's the whole idea behind caching.
Matheus28 5y ago
I have never seen these work. I've submitted a couple and they just go into a blackhole, never to hear from their hosting provider.

devwastaken 5y ago

Sue for copyright infringement, using discovery to compel the identity of the infringer, then continue to sue the infringer.

milankragujevic 5y ago

Regarding the IPs behind Cloudflare, when you send a DMCA notice to Cloudflare via email (meaning you don't need an account), Cloudflare will forward the notice to the host of the website, who will then take appropriate action. Cloudflare will usually also notify you about the origin IP of the website so you can further enforce your rights directly at the company which hosts the website.

brundolf 5y ago

Could that be treated as a trademark issue rather than a copyright issue?

akersten 5y ago

You (your client) can still subpoena Cloudflare for the customer's IP if you can get a court to agree that it's infringement and then go after the upstream host. That's seems like a solution compatible with this ruling, and an appropriate amount of lift.

mmis1000 5y ago
Some big parties always try to skip the court ruling and do whatever they want block the site without a law suit directly. Even the court ruling path exists there since forever and accomplish with the problem they claimed perfectly. Either because it is expensive or court obviously won't agree about every flawed claim they created. That isn't really a problem only in America. Some people in Taiwan also tries to pass similar law, end up get backfired when someone noticed it and stop the law creating process everytime. (And they still didn't give up )
TheCoelacanth 5y ago
Cloudflare, it seems, was perfectly willing to tell them identify of the customer without even going to court. > Cloudflare's security services do impact the ability of third parties to identify a website's hosting provider and the IP address of the server on which it resides. If Cloudflare's provision of these services made it more difficult for a third party to report incidents of infringement to the web host as part of an effort to get the underlying content taken down, perhaps it could be liable for contributory infringement. But here, the parties agree that Cloudflare informs complainants of the identity of the host in response to receiving a copyright complaint, in addition to forwarding the complaint along to the host provider.

ohazi 5y ago

This really doesn't seem like Cloudflare's problem. Did banks sue the Ford dealer for selling big V8 getaway cars to bank robbers? Or the city for operating the roads that they used to get away? Or the toll collector for letting the bank robbers cross a bridge after they paid the toll? No, because any of those things would have been ridiculous. At some point we as a society are going to have to get off this intellectual property high horse. Maybe we should stop trying to protect things that are easy to copy like website designs and wedding dresses. The enormous effort to try and protect these things damages society more than the benefit that even a successful outcome might have for a rights holder.

matheusmoreira 5y ago
> Maybe we should stop trying to protect things that are easy to copy like website designs and wedding dresses. Yeah. Copyright is nonsense in the 21st century where copying is trivial. It's holding us back.
- afiori 5y ago
  actually copyright only make sense if copying is easy, were copying hard then there would need no need for copyrights.
  - matheusmoreira 5y ago
    Has copying ever been this easy though? In centuries past, if you wanted to infringe copyright at the same scale we do today, you'd need expensive stuff like printing presses and a viable business model that pays for the costs of running an industrial copying process. That's what made copyright enforceable: you'd need to be a major industry player in order to infringe copyright and such centralized operations are easy targets for litigation. Now everyone's got computers that can make and distribute a virtually unbounded amount of copies of anything to anyone within the network and there's pretty much nothing people can do about that.
dymk 5y ago
A Ford dealership would be liable for selling counterfeit Fords, or at least would be responsible for helping track down where that counterfeit came from.

Causality1 5y ago

What due process do you believe Cloudflare should implement with regards to claims that a particular site on their service deserves to be booted?

markdown 5y ago
DMCA?
- RNCTX 5y ago
  Bad idea from top to bottom, glad someone outside of the Netherlands is ignoring it.

markdown 5y ago

> You also have a Cloudflare account to file a complaint, which I found to be odd. We're a Cloudflare customer too...but still that shouldn't be a hoop you have to jump through. I was once locked out of my Cloudflare account, and I couldn't contact them because to do so... required an account /* facepalm */ FYI, the way around this is to send an email to support@cloudflare.com. This isn't mentioned anywhere on the public-facing website. A truly bizarre way to treat paying customers.

jrochkind1 5y ago

> and we can't see who registered the domain or who hosts the site (since Cloudflare masks the IPs.) According to OP, it should be possible to get Cloudflare to tell you the originating IPs. I am not sure the mechanism though. From article: > But here, the parties agree that Cloudflare informs complainants of the identity of the host in response to receiving a copyright complaint, in addition to forwarding the complaint along to the host provider.

xxdesmus 5y ago
Not true -- according to the OP -- we'll tell you who the hosting provider is -- as in, the name and abuse email of the host. The origin IP is not needed.
- jrochkind1 5y ago
  Ah true, I assumed from the quote. I would think the origin IP would be needed for the hosting provider to identify their customer though? And the judge seemed pretty sure that the complainant could effectiely take it up with the hosting provider... still, there are lots of opportunities for misunderstanding here in case to judge to article to us. Not sure exactly what cloudflare will give you!
  - xxdesmus 5y ago
    Cloudflare sends the origin IP directly to the hosting provider -- with a copy of the abuse report.

xxdesmus 5y ago

>> "You also have a Cloudflare account to file a complaint, which I found to be odd." That's incorrect. Anyone can fill out the web reporting form here: cloudflare.com/abuse -- absolutely no Cloudflare account needed.

derefr 5y ago

Cloudflare does take reports seriously when a site exists to phish logins from another site’s users (whether that site is a clone, or just claims to be representing the other party when it isn’t.) Especially when that other site has a credit card form. Sadly, the most they can really do (about their regular Cloudflare Proxy clients, at least) is reveal to you the unmasked hosting info of the origin site; at which point you’ve got to start another process for reporting a TOS violation to the origin’s hosting provider.

1vuio0pswjnm7 5y ago

Why not name the phishing website. There are some methods for discovering the IP address of the origin server hidden behind Cloudflare. No guarantees but IME, many origin IPs are easily discovered.

Abishek_Muthian 5y ago

> we can't see who registered the domain or who hosts the site (since Cloudflare masks the IPs.) TIL Cloudflare is also a registrar[1], Might be even the cheapest. I was wondering why the parent wasn't able to find who the site belonged to through just WHOIS and sending a abuse request to the registrar, Still Cloudflare should be forwarding the abuse report not sure what's the case here. Can anyone tell share their experience with Cloudflare registrar? When compared to something like Namecheap? Also can different Cloudflare accounts for separate products use same credit cards for using the registration service? [1] https://www.cloudflare.com/products/registrar/ https://www.cloudflare.com/products/registrar/

fragmede 5y ago
In particular, the cloudflare registrar forces you to use their nameservers, which is totally fine if you understand the ramifications going in.
- Abishek_Muthian 5y ago
  That's a good point. I guess those who already have cloudflare nameservers wouldn't have an issue with it unless there are some issues with transferring the domain to cloudflare which already acts as your reverse proxy.

batch12 5y ago

Depending on the opsec of the group that stood the site up, this may still be possible to run down.

dragonwriter 5y ago

> We've reached out to Cloudflare to get them to take it down but nothing has been done. By “reached out”, I assume you don't mean “filed a DMCA takedown notice and, when they failed to take down the infringing material, filed a contributory copyright infringement lawsuit seeking both damages and a permanent injunction against Cloudflare making the infringing content available.” But I wonder why not? If there is a good reason not to, though, its probably also the reason that Cloudflare knows they can ignore you.