Erik van Straten<p><span class="h-card" translate="no"><a href="https://infosec.exchange/@SpaceLifeForm" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>SpaceLifeForm</span></a></span> wrote:<br><<< Why should a CDN have to police websites? >>></p><p>They don't. However, because Cloudflare abuses the knowledge that cybercriminals know that blocking Cloudflare's IP-address ranges will result in lots if false positives (for decent websites), this doesn't imply that Cloudflare should be able to get away with this. They DO have a responsibility.</p><p>The only things they have to do, instead if trying to fool us with the usual "freedom of speech" rubbish:</p><p>(1) Refuse anonymous or obviously identity-spoofing customers, such as:</p><p> • complaints-booking[.]info<br> • defi-chainfix.pages[.]de<br> • evri.mylocal-parcel-gb[.]com<br> • loginmicrosoftonlinecom.pages[.]dev<br> • ing.es-areacliente[.]com</p><p>See also <a href="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/its-raining-phish-and-scams-how-cloudflare-pages-dev-and-workers-dev-domains-get-abused/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">trustwave.com/en-us/resources/</span><span class="invisible">blogs/spiderlabs-blog/its-raining-phish-and-scams-how-cloudflare-pages-dev-and-workers-dev-domains-get-abused/</span></a> for abuse of Cloudflare's free workers.dev and pages.dev domains (the article is 1 year old but still very to the point);</p><p>(2) Refuse customers using known malicious IP-addresses and/or registrars;</p><p>(3) Treat complaints seriously - and listen to those who know, such as Mandiant (as can be seen in for example <a href="https://www.virustotal.com/gui/ip-address/188.114.96.0/relations" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">virustotal.com/gui/ip-address/</span><span class="invisible">188.114.96.0/relations</span></a>: tap ••• a couple of times until you see Mandiant in the third column);</p><p>(4) Always first show a warning page (shown before proceeding to actual site) for new customers, and more often show such a page after receiving complaints and/or when in doubt regarding the customer's intentions.</p><p>Cloudflare is complicit to cybercrime if they continue to facilitate it for their own profit - which is exactly what they and other Big Tech firms are doing right now (I call that <a href="https://infosec.exchange/tags/internetCancer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>internetCancer</span></a> ).</p><p>It is simply unfair that, on the current internet, everybody says that nobody is to blame (except the victims) if innocent individuals have their bank accounts drained, or companies file bankrupcy after ransomware gangs managed to penetrate their network perimeters via phishing attacks and/or hosted malware.</p><p>See also <a href="https://infosec.exchange/@ErikvanStraten/112883883343165898" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">infosec.exchange/@ErikvanStrat</span><span class="invisible">en/112883883343165898</span></a>.</p><p><span class="h-card" translate="no"><a href="https://infosec.exchange/@dangoodin" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>dangoodin</span></a></span> : thanks for the article: <a href="https://arstechnica.com/security/2024/07/cloudflare-once-again-comes-under-pressure-for-enabling-abusive-sites/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">arstechnica.com/security/2024/</span><span class="invisible">07/cloudflare-once-again-comes-under-pressure-for-enabling-abusive-sites/</span></a></p><p><a href="https://infosec.exchange/tags/DontBeEvil" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DontBeEvil</span></a> <a href="https://infosec.exchange/tags/LackOfAuthentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>LackOfAuthentication</span></a> <a href="https://infosec.exchange/tags/ShortSightedness" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ShortSightedness</span></a> <a href="https://infosec.exchange/tags/Cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybercrime</span></a> <a href="https://infosec.exchange/tags/BulletProofHosting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>BulletProofHosting</span></a> <br><a href="https://infosec.exchange/tags/AllowingAnonymousBusinesses" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AllowingAnonymousBusinesses</span></a> <a href="https://infosec.exchange/tags/Cloudflare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cloudflare</span></a> <a href="https://infosec.exchange/tags/Google" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Google</span></a> <a href="https://infosec.exchange/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Microsoft</span></a> <a href="https://infosec.exchange/tags/Amazon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Amazon</span></a> <a href="https://infosec.exchange/tags/Fastly" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Fastly</span></a></p>