Comment by oneplane | Hacker News Reader

Comment by oneplane | Hacker News Reader

Hanlon's razor suggests either human error (someone putting in the wrong DNS entry on their end) or someone abusing a cloudflare service.

All the other suggestions of malice are rather inefficient, especially considering the net value is lower than the cost to push those malicious actions.

As for the reporting: yeah, it seems rather dumb there is no easy to reach form for this, but you can message their abuse address and NOC which are listed in the WHOIS you probably queried anyway to find out Cloudflare owns those addresses:

  RNOCHandle: NOC11962-ARIN
  RNOCName:   NOC
  RNOCPhone:  +1-650-319-8930 
  RNOCEmail:  noc@cloudflare.com
  RNOCRef:    https://rdap.arin.net/registry/entity/NOC11962-ARIN

  RAbuseHandle: ABUSE2916-ARIN
  RAbuseName:   Abuse
  RAbusePhone:  +1-650-319-8930 
  RAbuseEmail:  abuse@cloudflare.com
  RAbuseRef:    https://rdap.arin.net/registry/entity/ABUSE2916-ARIN

A phone call might be quicker if you're really curious about what is happening.

The phone number is listed on CloudFlare's website as their international sales number, so I am skeptical that it goes anywhere useful to OP

When I used to call them I just asked for the NOC and they connected me to the NOC first line handler. Might be different now (~3 years difference).

I'm surprised that you could reach a NOC as recently as three years ago. A few decades ago, it was fairly easy to contact a NOC. Nowadays many NOCs don't even allow phones that are reachable from the PSTN. This is done to increase "security" by making social engineering attacks impossible.

Yes, I just tried, and the phone number just goes to a menu system with no way to talk to a human. If you choose abuse, it tells you to report it online. If you choose support it tells you that if you're an enterprise customer you can create a ticket. If you choose the "under attack" option, then do send you to a human who tries to sell you cloudflare service and doesn't understand that cloudflare could possibly be attacking you (and refuses to transfer you).

I tried emailing the abuse address, but I get an automated reply saying to report it using the online form (which won't let you report anything not hosted on a cloudflare website).

I also emailed their noc address and haven't had an automated reply yet, so perhaps that will actually reach a human.

As far as I could tell, the handler wasn't inside the NOC, but was able to contact them directly. I suppose 1st and 2nd level don't actually have to be inside the NOC to be of use.

Wouldn't be surprised it they do some sort of CLIP filtering/routing, or if they no longer use humans on the front lines, it's the way of the enterprise once they exist long enough :-(

Reply on news.ycombinator.com