3 ms·

Of the 10 highest ranked "stresser" (DDoS-for-hire) services on DuckDuckGo right now, 9 of them are using Cloudflare. jetstress.net - Cloudflare maxstresser.c

Of the 10 highest ranked "stresser" (DDoS-for-hire) services on DuckDuckGo right now, 9 of them are using Cloudflare. jetstress.net - Cloudflare maxstresser.com - Cloudflare neostress.cc - Cloudflare quezstresser.ru - Cloudflare rawstresser.net - Cloudflare stresse.net - Cloudflare stresser.su - Cloudflare stresser.zone - Cloudflare stresserst.su - DDoSGuard sunnystresser.com - Cloudflare I could keep going but you get the point. This has been ongoing for years and they consistently ignore abuse reports. Given that CFs bread and butter is selling DDoS mitigation this is a blatant conflict of interest.

robertlagrant 2y ago
Is the problem that the stressor services don't have robust KYC?
- jsheard 2y ago
  Legit load testing services like loader.io require you to prove you own the site you are targeting, yes. "Stressers" let you point their orbital laser at whatever you want, they might say it's only meant for use against your own servers but that's just an ass-covering pretense.
  - robertlagrant 2y ago
    Sure. But that's what I'm asking. Why blame Cloudflare rather than the companies themselves?
    - jsheard 2y ago
      DDoS providers and other for-profit miscreants are incentivized to DDoS each other into oblivion, and Cloudflare is the only one of the giant mitigation providers who are willing to protect them from their competition. There are bulletproof alternatives like DDoSGuard but their network is absolutely nowhere near as expansive as CFs is, nor is it free to use, nor do they have enough legit customers to rule out blocking their entire ASN in a corporate filewall to stop phishing attacks. CFs share of the blame is for making bad actors lives much easier than it should be.
      - Dylan16807 2y ago
        I feel like the portion of blame for stopping criminals from attacking each other is pretty low.
- duskwuff 2y ago
  That would imply that those services have legitimate use cases. Most of them don't, and they're well aware of it.
readyplayernull 2y ago
> Given that CFs bread and butter is selling DDoS mitigation this is a blatant conflict of interest. There is no conflict when the goal is making money. They'll be glad to look the other way.

robertlagrant 2y ago

Is the problem that the stressor services don't have robust KYC?

jsheard 2y ago
Legit load testing services like loader.io require you to prove you own the site you are targeting, yes. "Stressers" let you point their orbital laser at whatever you want, they might say it's only meant for use against your own servers but that's just an ass-covering pretense.
- robertlagrant 2y ago
  Sure. But that's what I'm asking. Why blame Cloudflare rather than the companies themselves?
  - jsheard 2y ago
    DDoS providers and other for-profit miscreants are incentivized to DDoS each other into oblivion, and Cloudflare is the only one of the giant mitigation providers who are willing to protect them from their competition. There are bulletproof alternatives like DDoSGuard but their network is absolutely nowhere near as expansive as CFs is, nor is it free to use, nor do they have enough legit customers to rule out blocking their entire ASN in a corporate filewall to stop phishing attacks. CFs share of the blame is for making bad actors lives much easier than it should be.
    - Dylan16807 2y ago
      I feel like the portion of blame for stopping criminals from attacking each other is pretty low.
duskwuff 2y ago
That would imply that those services have legitimate use cases. Most of them don't, and they're well aware of it.

readyplayernull 2y ago

> Given that CFs bread and butter is selling DDoS mitigation this is a blatant conflict of interest. There is no conflict when the goal is making money. They'll be glad to look the other way.