Hacker News Reader

Comment by throwaway2048 | Hacker News Reader

throwaway2048

Wonder why DDOSes have been getting worse lately? DDOS groups are putting their sites behind Cloudflare so they cannot be DDOSed off the internet by rival groups, thus their "services" become a lot more accessible, and they have grown bolder.

This is a grave conflict of interest for Cloudflare, they have no incentive to stop them, after all, it generates more business for Cloudflare.

This absolutely needs to be addressed.

http://krebsonsecurity.com/2013/05/ddos-services-advertise-o...

View on HN

This site has compiled an interesting collection of observations: http://crimeflare.com

Those services have existed for years before Cloudflare came around. They'll continue to exist even after they're welcome on Cloudflare.

Censorship-resistant networks are an incredibly powerful tool, for good and bad uses alike. We shouldn't criticize the tool just because some choose to use it in a way we disagree with.

It is because many DDoS websites sitting behind Cloudflare are FBI run. See titaniumstresser[0] as an example. One of their sub-domain's IP address is allocated to the FBI[1]. Seems like the longest lasting sites peddling stolen info, child pornography, or malicious services are all run by feds.

Hostname: direct.titaniumstresser.net IP Address: 153.31.25.12 Organization: FBI Criminal Justice Information Systems

[0] http://titaniumstresser.net/

[1] http://direct.titaniumstresser.net.ipaddress.com/

LOL, that's just so someone (of a rival group) who tries to get their real IP address (to ddos them), finds that subdomain, and doesn't look closely, and goes to ddos the FBI.

Correct.

Many automated scripts script kiddies use to DDoS will do a basic check for subdomains like "direct.domain.com" and "direct-connect.domain.com" if the target domain is behind Cloudflare, and the scripts are naive and immediately assume that's the server's real IP.

Setting it to the IP of a site they dislike is also a popular choice.

That's not how you think it works. You can point domains you own at any IP you like.

I could point my personal domain at the FBI in 3 seconds if I felt like it, completely legal and commonplace.

Reply on news.ycombinator.com