The underlying issue is how BGP and peering works behind the scenes. BGP relies heavily on mutual trust that nobody claims an ASN they are not supposed to have

The underlying issue is how BGP and peering works behind the scenes. BGP relies heavily on mutual trust that nobody claims an ASN they are not supposed to have and that have no overlaps. But, if you analyze the registry datasets, there will be always two culprits that claim ownership of networks for surveillance reasons :) Then there is the fact that cloudflare is hosting sooo many malicious actors in the field that their own business model shifted into hosting crime as a service, while also offering "protection" against their own customers. There was this one guy that ran a custom DNS resolver to expose this, you can search the web archive for the "crimeflare" website where he hosted it (and got DDoSed by cloudflare, too, btw). And then there is the problem with peering. As you said, peering providers could have just checked whether or not the source comes from within one of their networks, but they don't do that. Most amplification attacks cross those peering lines/ASNs, yet we see cloudflare's DNS being the single most DDoSing server on the internet, while simultaneously providing said protection from exactly that attack type. [1] http://web.archive.org/web/20240000000000*/http://crimeflare.org:82 http://web.archive.org/web/20240000000000*/http://crimeflare... [2] http://web.archive.org/web/20190620030133/http://www.crimeflare.org:82/cfs.html#box http://web.archive.org/web/20190620030133/http://www.crimefl...