Cloudflare loses 22% of its domains in Freenom .tk shutdown

Looking back this could have been to slow robots down, but I distinctly remember one if the terms being you speak and host English content.

Another service I used a lot was " dominosfree" which had a bunch of .gs domains that looked like CC-tlds. I used .ca.gs a lot.

I also miss tripod, not sure if its still around how it used to be. Angelfire comes to mind too.

$7/yr for a domain was one of the very first internet purchases I made. Then that set me down a path of finding free dynamic DNS services. For a short time my website and Invision forum were only online when I was, but I felt like I'd beaten the advertisers.

Heh. I remember thinking '©' and '®' being cool letters. I put it on every page since it looked pro. I guess you didn't actually register the "brand"?

Later on in the UK I put a site on a madasafish domain.

There are multitudes in every group.

So they're criminals as far as the US and allies are concerned, but de facto not criminals where they live. If they're going to be locked out of the system, it has to be by the infrastructure, because their government has no interest in stopping them.

Our legal system is unfortunately not perfect, which is why it matters what infrastructure providers do.

Do they enable criminals by shielding them from the police? Or do they have policies in place that prevent abuse of their service?

With Cloudflare, I'm pretty sure they lean towards the former.

To answer your question: most malware actors can be traced back to Russia, what exactly do you think "sending the cops" after them will accomplish and if the answer is "nothing", then does that mean you don't think they can be called criminals?

"We do not host the website" was always there response, while that is perhaps technically true, arguing if they shut down the reverse proxying for that website it would be at least offline, never worked.

What time? What mitigations?

Cloudflare will proxy anything and then tell you "we're just a proxy, so we wont do anything lol" when you report anything other than cf pages. Doesn't matter if it's terror groups, animal torture, piracy, doxing, far right groups, etc.

I have personally submitted abuse reports and seen that absolutely nothing happens.

Oh and also the amount of abuse I see from people using Cloudflare Warp is also very high.

Cloudflare will happily take money from and host (yes, host - they host, in spite of their rather stupid and completely disingenuous assertions that they don't) spammers and scammers. They do all the time, and they have no intention of changing that any time soon.

If you forward phishing spam to abuse@cloudflare.com, guess what? Nothing happens. You get an automated response, but they do nothing about it. They expect you to visit a web page that has all sorts of intentional problems (intentional because they've been pointed out to Cloudflare and Cloudflare hasn't addressed them for years) that make the process arduous and time consuming. For one, they don't have "spam" as an abuse type. For another, even though they now literally host web content, and even though they're a domain registrar, if you don't paste in a URL pointing to a site hosted by their proxying product, then you can't submit your form. This means there's literally no way to complain to Cloudflare about domains for which Cloudflare is in WHOIS and SOA records, and for whom Cloudflare hosts DNS. The fields are limited to some particular size (2,000 characters? I forget exactly), and have issues where if you paste more than a certain amount of content but less than the hard limit, you can't submit the form. If you try to use the form more than once a minute or two, IT'S RATE LIMITED and you can't submit the form. Imagine that - they need to protect themselves from human-speed abuse reporting.

In other words, it's REALLY hard to use their site to report abuse to them, and they know this, and it's intentional, unless we want to believe that they just suck at understanding how to make a web page that works.

If they get enough complaints about a given phishing domain, they eventually take action, but it'd be after several days, which is more than the lifetime of a typical phishing campaign. In essence Cloudflare is one of the most popular phishing and spam-promoted hosting platforms because of Cloudflare's intentional foot dragging and claims to want to "protect free speech".

They got on my shit list years ago when they told me - not kidding - that they couldn't just take down a Bank of America phishing site when it was pointed out to them because of "free speech". In other words, they don't want to set a precedent where they can apply the tiniest modicum of common sense and take down phishing sites which any reasonable human on the planet can unambiguously recognize as fraud.

Bottom line: Cloudflare tells the world that there's SO much bad stuff out there, and you'll get in trouble if you don't use their products, and that's mostly true if you want to run phishing and spam-promoted web sites, so scammers and spammers use Cloudflare and are protected from those of us who would report those spammers and scammers.

For all the companies and individuals who use Cloudflare, many are fooled in to thinking they need Cloudflare when they don't and are just making their sites problematic for much of the non-western world while helping a wanna-be monopoly re-centralize the Internet around a for-profit company that has a history of profiting from scammers and spammers.

If anyone thinks Cloudflare legitimately protects the Internet by mitigating fraud and abuse, I'd be very interested to see evidence that doesn't come from Cloudflare that shows this.

Which is where the crackdown should happen.

If there's no abuse, nobody will pay their protection money.

Let's do Akamai, but cheaper. Trying to stop everything bad is impossible anyway.

Only if the abuse happened through them. Perhaps they were just hosting holding pages, and the traffic was pushed elsewhere when active scams were running?

> surprises me, given the time and effort they spend mitigating fraud and abuse

They mitigate it incoming as one of their features for their customers. That doesn't mean they are going to mitigate it outgoing quite as fiercely. Though I'd assume they'd made some effort at least to maintain a reasonable reputation for their IP ranges.

No, this is (obviously) contrarianism for contrarianisms sake.

It's good when entities facilitating crime stop facilitating it. No debate necessary.

Additionally, it's completely unclear what you mean by your proposal.

But to your point, using a ‘off-brand’ can really hurt sometimes. `.af` might be a cute marketing tactic, but it’s actually Afghanistan, and the Taliban play by a different rulebook. I believe it was `gay.af` that found that out the hard way. Tons of other stories.

Not sure how common that is. But I don't think it's a given that all sites hosted on .tk domains are unwilling to pay, especially not if you consider that they must be somewhat popular if they need a CDN.

(The sort of personal homepage that most of us had back in the 90s would never need a CDN because it would get 5 hits per week.)