Research into websites that are openly advertising services to a cybercriminal audience, such as bulletproof hosting, reveals that many of these domains are supported by Cloudflare’s services, the NGO Spamhaus says.
For years, Spamhaus has observed abusive activity facilitated by Cloudflare’s various services. Cybercriminals have been exploiting these legitimate services to mask activities and enhance their malicious operations, a tactic referred to as living off trusted services (LOTS).
With 1201 unresolved Spamhaus Blocklist (SBL) listings, it is clear that the state of affairs at Cloudflare’s Connectivity Cloud looks less than optimal from an abuse-handling perspective, Spamhaus writes on its website. 10.05% of all domains listed on Spamhaus’s Domain Blocklist (DBL), which indicates signs of spam or malicious activity, are on Cloudflare nameservers . Spamhaus routinely observes miscreants moving their domains, which are already listed in the DBL, to Cloudflare to disguise the backend of their operation, be it spamvertized domains, phishing, or worse.
Cloudflare apparently has 14% to 16% of the DNS market but only serves 10% of domain names for spammers, according to this blog post. That means a site being hosted on Cloudflare is actually a reason to trust an email more, not less, by pure statistics.
Unlike other hosts, Cloudflare offers a DNS server that’s easy to script against, cheap, and actually works well. A combination of three factors I haven’t seen another DNS host do. Of course spammers are going to flock to services like these. Kick over Cloudflare and the next most bot-friendly DNS provider will take the spammers instead.
I get why that one security vendor published a blog post about Cloudflare recently (after all, they make money selling scary news articles) but I don’t really get why Spamhaus is publishing this. They link to their own “how to prevent abuse” page which comes down to “take basic personal information (because criminals would never lie), don’t take crypto (anonymity == criminal), use our various services”.
As for the “bulletproof hosters” part: Cloudflare tries not to make ethical decisions about their customers. Given the position they’re in as middle man to at least 20% of the entire internet (80% of CDNs), I don’t think I want them to make any decisions about who can and who can’t use their services. In fact, if they start picking and choosing their customers and what they host, that increases their liability when illegal stuff does happen on their platform. The internet is free because hosters don’t need to manually approve the stuff they’re hosting as long as they follow up on legal issues; if they start picking and choosing, they’re on the hook for stuff they misjudged or missed.
SpamHaus can flag Cloudflare domains as a spam/phishing risk if they want to (but I doubt they will, as that would affect their own emails as well, seeing as they are hosted behind Cloudflare). I don’t see why they would need to make a public blog post about their problems.
It’s a bit more about how miserable it is to work with Cloudflare and their unwillingness to remove abuse in general, opting to say they’re “not the host” and that they cannot tell you where it is but they cannot do anything. It’s hardly an ethical decision to say that phishing and bulletproof hosting aren’t the bedfellows you want.
Good!
I really really don’t want cloudflare to gatekeep what is or isn’t allowed on the internet. That is the job of the hoster and/or NIC and at very worse the ISP of the hoster.
People who don’t work in fraud or abuse don’t understand how miserable Cloudflare is to work with. They have a single email box I can send to for identifying if I host a website that takes them days to respond to, no automation by the year of our lord 2024.
