6 ms·

Spammers are exploiting cloudflare by creating thousands of new domains on the free tld (like .ml) and hosting the sites behind cloudflare and spamming social m

Spammers are exploiting cloudflare by creating thousands of new domains on the free tld (like .ml) and hosting the sites behind cloudflare and spamming social media apps with links to scam dating sites. CPA scammers. If anyone from CF sees this, I can work with you and give you data on this. I’m dealing with this at one of the large social media companies. Here's an example, this is NSFW - https://atragcara.ga https://atragcara.ga

sschueller 4y ago
Same goes for DDoS attacks. I am not sure how they do it but we get hit by CF IPs with synfloods etc.
- slothsarecool 4y ago
  You do not get attacked from Cloudflare with TCP attacks. Somebody is spoofing the IP header and make it seem like Cloudflare is DDoSing you. The only way for somebody to DDoS from Cloudflare would be using workers, however, this isn't practical as workers have a very limited IP Range.
  - fncivivue7 4y ago
    Why are you assuming amplification attacks aren't a thing? I think you're probably right about the spoofing but it comes off a little dismissive when the possibility of a site that queries other sites, could be tricked into doing something it shouldn't, is always going to be in the realm of a possibility.
  - cmeacham98 4y ago
    The reason people do this, by the way, is because it's common if you're hosting via CF to whitelist their IPs and block the rest. This allows their SYN flood to bypass that.
  - patricklorio 4y ago
    I run a fairly popular service and have received DDoS attacks from Cloudflare's IP range (~20gbps). I can confirm they respond to SYN+ACK with an ACK to complete the TCP handshake. Through some investigating it seems like a botnet using Cloudflare WARP (their VPN service).
- gnfargbl 4y ago
  Anyone can set the source IP on their packets to be anything. I can send you TCP SYNs which are apparently from Cloudflare. There was a proposal (BCP38) which said that networks should not allow outbound packets with source IPs which could not originate from that network, but it didn't really get a lot of traction -- mainly due to BGP multihoming, I think.
  - toast0 4y ago
    BCP38 has gotten some traction, but it's not super effective until all the major tier-1 ISPs enforce it against their customers. But it's hard to pressure tier-1 ISPs; you can't drop connections with them, because they're too useful, anyway if you did, the traffic would just flow through another tier-1 ISPs, because it's not really realistic for tier-1s to prefix filter peerings between themselves. Anyway, the customer that's spoofing could be spoofing sources their ISP legitimagely handles, and there's a lot of those. Some tier-1s do follow BCP38 though, so one day maybe? Still, there's plenty of abuse to be done without spoofing, so while it would be an improvement, it wouldn't usher in an era of no abuse.
elorant 4y ago
So why aren't social media platforms blocking the domains?
- ronnier 4y ago
  We do. But with free TLD's, spammers and scammers can create an unlimited number of new domains at zero cost. That's the problem. They can send a single spam URL to a single person and scale that out, each person gets a unique domain and URL.
  - gnfargbl 4y ago
    OK, but why don't you block Freenom domains entirely? Apart from perhaps a couple of sites like gob.gq, there's essentially nothing of any value on those TLDs. Allow-list the handful of good sites, if you must, and default block the rest.
    - ronnier 4y ago
      I could. But we are talking about one of the worlds largest social media platforms used by hundreds of millions of people daily. There’s legit websites hosted on these free domains and I don’t want to kill those along with the scam sites. I’ve mostly got the scam sites blocked at this point though. Just took me a week or so to adapt.
      - gnfargbl 4y ago
        > There’s legit websites hosted on these free domains Are there though, really? Can you give some examples? To a first approximation, I contend that essentially everything on Freenom is bad. There are maybe a handful of good sites (the one I listed, https://koulouba.ml/ https://koulouba.ml/, etc) but you can find those on Google in a few minutes with some site: searches. I commend your efforts in blocking the scam sites, but also honestly believe that it would be better for you, your customers and the internet at large to default block Freenom. Freenom sites are junk, wherever they are hosted.
deleted 4y ago
[deleted]

sschueller 4y ago

Same goes for DDoS attacks. I am not sure how they do it but we get hit by CF IPs with synfloods etc.

slothsarecool 4y ago
You do not get attacked from Cloudflare with TCP attacks. Somebody is spoofing the IP header and make it seem like Cloudflare is DDoSing you. The only way for somebody to DDoS from Cloudflare would be using workers, however, this isn't practical as workers have a very limited IP Range.
- fncivivue7 4y ago
  Why are you assuming amplification attacks aren't a thing? I think you're probably right about the spoofing but it comes off a little dismissive when the possibility of a site that queries other sites, could be tricked into doing something it shouldn't, is always going to be in the realm of a possibility.
- cmeacham98 4y ago
  The reason people do this, by the way, is because it's common if you're hosting via CF to whitelist their IPs and block the rest. This allows their SYN flood to bypass that.
- patricklorio 4y ago
  I run a fairly popular service and have received DDoS attacks from Cloudflare's IP range (~20gbps). I can confirm they respond to SYN+ACK with an ACK to complete the TCP handshake. Through some investigating it seems like a botnet using Cloudflare WARP (their VPN service).
gnfargbl 4y ago
Anyone can set the source IP on their packets to be anything. I can send you TCP SYNs which are apparently from Cloudflare. There was a proposal (BCP38) which said that networks should not allow outbound packets with source IPs which could not originate from that network, but it didn't really get a lot of traction -- mainly due to BGP multihoming, I think.
- toast0 4y ago
  BCP38 has gotten some traction, but it's not super effective until all the major tier-1 ISPs enforce it against their customers. But it's hard to pressure tier-1 ISPs; you can't drop connections with them, because they're too useful, anyway if you did, the traffic would just flow through another tier-1 ISPs, because it's not really realistic for tier-1s to prefix filter peerings between themselves. Anyway, the customer that's spoofing could be spoofing sources their ISP legitimagely handles, and there's a lot of those. Some tier-1s do follow BCP38 though, so one day maybe? Still, there's plenty of abuse to be done without spoofing, so while it would be an improvement, it wouldn't usher in an era of no abuse.

elorant 4y ago

So why aren't social media platforms blocking the domains?

ronnier 4y ago
We do. But with free TLD's, spammers and scammers can create an unlimited number of new domains at zero cost. That's the problem. They can send a single spam URL to a single person and scale that out, each person gets a unique domain and URL.
- gnfargbl 4y ago
  OK, but why don't you block Freenom domains entirely? Apart from perhaps a couple of sites like gob.gq, there's essentially nothing of any value on those TLDs. Allow-list the handful of good sites, if you must, and default block the rest.
  - ronnier 4y ago
    I could. But we are talking about one of the worlds largest social media platforms used by hundreds of millions of people daily. There’s legit websites hosted on these free domains and I don’t want to kill those along with the scam sites. I’ve mostly got the scam sites blocked at this point though. Just took me a week or so to adapt.
    - gnfargbl 4y ago
      > There’s legit websites hosted on these free domains Are there though, really? Can you give some examples? To a first approximation, I contend that essentially everything on Freenom is bad. There are maybe a handful of good sites (the one I listed, https://koulouba.ml/ https://koulouba.ml/, etc) but you can find those on Google in a few minutes with some site: searches. I commend your efforts in blocking the scam sites, but also honestly believe that it would be better for you, your customers and the internet at large to default block Freenom. Freenom sites are junk, wherever they are hosted.

deleted 4y ago

[deleted]