3 ms·

Wonder why DDOSes have been getting worse lately? DDOS groups are putting their sites behind Cloudflare so they cannot be DDOSed off the internet by rival group

by throwaway2048 12y ago

Wonder why DDOSes have been getting worse lately? DDOS groups are putting their sites behind Cloudflare so they cannot be DDOSed off the internet by rival groups, thus their "services" become a lot more accessible, and they have grown bolder. This is a grave conflict of interest for Cloudflare, they have no incentive to stop them, after all, it generates more business for Cloudflare. This absolutely needs to be addressed. http://krebsonsecurity.com/2013/05/ddos-services-advertise-openly-take-paypal/ http://krebsonsecurity.com/2013/05/ddos-services-advertise-o...

yetanotherHNacc 12y ago
It is because many DDoS websites sitting behind Cloudflare are FBI run. See titaniumstresser[0] as an example. One of their sub-domain's IP address is allocated to the FBI[1]. Seems like the longest lasting sites peddling stolen info, child pornography, or malicious services are all run by feds. Hostname: direct.titaniumstresser.net IP Address: 153.31.25.12 Organization: FBI Criminal Justice Information Systems [0] http://titaniumstresser.net/ http://titaniumstresser.net/ [1] http://direct.titaniumstresser.net.ipaddress.com/ http://direct.titaniumstresser.net.ipaddress.com/
- slipstream- 12y ago
  LOL, that's just so someone (of a rival group) who tries to get their real IP address (to ddos them), finds that subdomain, and doesn't look closely, and goes to ddos the FBI.
  - meowface 12y ago
    Correct. Many automated scripts script kiddies use to DDoS will do a basic check for subdomains like "direct.domain.com" and "direct-connect.domain.com" if the target domain is behind Cloudflare, and the scripts are naive and immediately assume that's the server's real IP. Setting it to the IP of a site they dislike is also a popular choice.
- hnha 12y ago
  That's not how you think it works. You can point domains you own at any IP you like.
- Igglyboo 12y ago
  I could point my personal domain at the FBI in 3 seconds if I felt like it, completely legal and commonplace.
dublinben 12y ago
Those services have existed for years before Cloudflare came around. They'll continue to exist even after they're welcome on Cloudflare. Censorship-resistant networks are an incredibly powerful tool, for good and bad uses alike. We shouldn't criticize the tool just because some choose to use it in a way we disagree with.
stevenh 12y ago
This site has compiled an interesting collection of observations: http://crimeflare.com http://crimeflare.com

yetanotherHNacc 12y ago

It is because many DDoS websites sitting behind Cloudflare are FBI run. See titaniumstresser[0] as an example. One of their sub-domain's IP address is allocated to the FBI[1]. Seems like the longest lasting sites peddling stolen info, child pornography, or malicious services are all run by feds. Hostname: direct.titaniumstresser.net IP Address: 153.31.25.12 Organization: FBI Criminal Justice Information Systems [0] http://titaniumstresser.net/ http://titaniumstresser.net/ [1] http://direct.titaniumstresser.net.ipaddress.com/ http://direct.titaniumstresser.net.ipaddress.com/

slipstream- 12y ago
LOL, that's just so someone (of a rival group) who tries to get their real IP address (to ddos them), finds that subdomain, and doesn't look closely, and goes to ddos the FBI.
- meowface 12y ago
  Correct. Many automated scripts script kiddies use to DDoS will do a basic check for subdomains like "direct.domain.com" and "direct-connect.domain.com" if the target domain is behind Cloudflare, and the scripts are naive and immediately assume that's the server's real IP. Setting it to the IP of a site they dislike is also a popular choice.
hnha 12y ago
That's not how you think it works. You can point domains you own at any IP you like.
Igglyboo 12y ago
I could point my personal domain at the FBI in 3 seconds if I felt like it, completely legal and commonplace.

dublinben 12y ago

Those services have existed for years before Cloudflare came around. They'll continue to exist even after they're welcome on Cloudflare. Censorship-resistant networks are an incredibly powerful tool, for good and bad uses alike. We shouldn't criticize the tool just because some choose to use it in a way we disagree with.

stevenh 12y ago

This site has compiled an interesting collection of observations: http://crimeflare.com http://crimeflare.com