Cloudflare has been infamous among sysadmins and threat hunters for over a decade [1,2] now for having an almost-nonexistent moderation program. Their services have been routinely abused by malicious actors for years [3,4,5,6,7] They've arguably been the single largest commercial provider for criminals globally over that time period, including non-tech criminals like drug traffickers and actual terrorists [8,9], to say nothing of aiding and abetting war criminals [10].

In fact, Cloudflare is actually the second largest DNS provider in the world by number of domains served. [11]

They are in a position to log and analyze all of the traffic they decrypt, including all of the plaintext POST data, all of the cookies, all of the origin IPs, L7 payload sizes, and traffic timestamps for over 35 million websites.

Their extensive history of indiscriminately offering "free" services to evildoers likely ties back to their true purpose, which Matthew Prince has admitted to [12], which is to sell all of those passwords, all of that PII, all of your privacy, not only to the US government, but also to other bidders.

It is no exaggeration to say that anyone opposed to spam, phishing, malware, cybercrime, terrorism, war crimes, government surveillance dragnets, and infringements upon one's own digital privacy should have nothing but utter contempt for the soulless monsters responsible for this corporate atrocity.

If you are as passionate about the subject as I am after reading some of these citations, I'd encourage you to boycott any websites using CF that you don't need to visit, and make plenty of phone calls to California senators, representatives, and the governor demanding that the state of California revoke Cloudflare's corporate charter and right to conduct business in the state.

[1] https://www.malwarebytes.com/blog/news/2014/12/free-ssl-cert...

[2] https://forum.spamcop.net/topic/14194-cloudflare-bulletproof...

[3] https://thehackernews.com/2023/08/cybercriminals-abusing-clo...

[4] https://www.threatdown.com/blog/cloudflare-tunnel-increasing...

[5] https://any.run/cybersecurity-blog/clouflare-phishing-campai...

[6] https://venturebeat.com/security/rogue-ad-network-site-likel...

[7] https://portswigger.net/daily-swig/cybercriminals-use-revers...

[8] https://www.trendmicro.com/vinfo/us/security/news/cybercrime...

[9] https://cyberscoop.com/cloudflare-ipo-terrorism-narcotics/

[10] https://www.timesofisrael.com/us-firm-helps-hamas-netanyahu-...

[11] https://bgp.he.net/report/tophosts

[12] https://0xacab.org/blockedbyriseup/deCloudflare/-/raw/master...