Hacker News Reader

Comment by ronnier | Hacker News Reader

Spammers are exploiting cloudflare by creating thousands of new domains on the free tld (like .ml) and hosting the sites behind cloudflare and spamming social media apps with links to scam dating sites. CPA scammers.

If anyone from CF sees this, I can work with you and give you data on this. I’m dealing with this at one of the large social media companies.

Here's an example, this is NSFW - https://atragcara.ga

View on HN

Same goes for DDoS attacks. I am not sure how they do it but we get hit by CF IPs with synfloods etc.

You do not get attacked from Cloudflare with TCP attacks. Somebody is spoofing the IP header and make it seem like Cloudflare is DDoSing you.

The only way for somebody to DDoS from Cloudflare would be using workers, however, this isn't practical as workers have a very limited IP Range.

Why are you assuming amplification attacks aren't a thing?

I think you're probably right about the spoofing but it comes off a little dismissive when the possibility of a site that queries other sites, could be tricked into doing something it shouldn't, is always going to be in the realm of a possibility.

The reason people do this, by the way, is because it's common if you're hosting via CF to whitelist their IPs and block the rest. This allows their SYN flood to bypass that.

I run a fairly popular service and have received DDoS attacks from Cloudflare's IP range (~20gbps). I can confirm they respond to SYN+ACK with an ACK to complete the TCP handshake. Through some investigating it seems like a botnet using Cloudflare WARP (their VPN service).

Anyone can set the source IP on their packets to be anything. I can send you TCP SYNs which are apparently from Cloudflare.

There was a proposal (BCP38) which said that networks should not allow outbound packets with source IPs which could not originate from that network, but it didn't really get a lot of traction -- mainly due to BGP multihoming, I think.

BCP38 has gotten some traction, but it's not super effective until all the major tier-1 ISPs enforce it against their customers. But it's hard to pressure tier-1 ISPs; you can't drop connections with them, because they're too useful, anyway if you did, the traffic would just flow through another tier-1 ISPs, because it's not really realistic for tier-1s to prefix filter peerings between themselves. Anyway, the customer that's spoofing could be spoofing sources their ISP legitimagely handles, and there's a lot of those.

Some tier-1s do follow BCP38 though, so one day maybe? Still, there's plenty of abuse to be done without spoofing, so while it would be an improvement, it wouldn't usher in an era of no abuse.

So why aren't social media platforms blocking the domains?

We do. But with free TLD's, spammers and scammers can create an unlimited number of new domains at zero cost. That's the problem. They can send a single spam URL to a single person and scale that out, each person gets a unique domain and URL.

OK, but why don't you block Freenom domains entirely?

Apart from perhaps a couple of sites like gob.gq, there's essentially nothing of any value on those TLDs. Allow-list the handful of good sites, if you must, and default block the rest.

I could. But we are talking about one of the worlds largest social media platforms used by hundreds of millions of people daily. There’s legit websites hosted on these free domains and I don’t want to kill those along with the scam sites. I’ve mostly got the scam sites blocked at this point though. Just took me a week or so to adapt.

> There’s legit websites hosted on these free domains

Are there though, really? Can you give some examples?

To a first approximation, I contend that essentially everything on Freenom is bad. There are maybe a handful of good sites (the one I listed, https://koulouba.ml/, etc) but you can find those on Google in a few minutes with some site: searches.

I commend your efforts in blocking the scam sites, but also honestly believe that it would be better for you, your customers and the internet at large to default block Freenom. Freenom sites are junk, wherever they are hosted.

Here's NSFW scam sites behind CF that use free TLDs. I could post 10s of thousands of these.

* https://atragcara.ga

* https://donaga.tk

* https://snatemhatzemerbedc.tk

Yep, I know. I monitor these as they appear in Certificate Transparency logs and DNS PTR records.

Freenom TLDs are just junk. Save yourself the hassle and default block :-).

Seems these sites should be blocked on CF, at the root. Not all the leaf nodes apps. It’s pretty easy for me to automate it at my company. Seems CF could?

So how about blocking the users then? Or limit their ability to post links.

That's done too. But it's not just a few, it's literally 10s of thousands of individuals from places like Bangladesh who do this as their source of income. They are smart, on real devices, will solve any puzzle you throw at them, and will adapt to any blocks or locking. It's not an easy problem to solve which is why no platform has solved it (oddly, spam is pretty much non existent on HN)

I don't think there's any benefit in spamming HN. There aren't that many users in here, and it could lead to a backlash consider the technical expertise of most people.

Reply on news.ycombinator.com