HN Explorer

Tell HN: Cloudflare Hosted Illegal Content on My Domain

8 points by leoh ↗ HN
I got an urgent email from Namecheap this evening that illegal content was being hosted on one of my domains. I checked the DNS and I had set the nameservers to Cloudflare, but had never used Cloudflare for hosting.

I tried submitting an abuse form to Cloudflare, but their automated form claimed they did not manage the domain -- which is patently untrue, given that the IP resolves to their servers.

How could this even happen? And what recourse do I have, if any?

11 comments

[ 3.3 ms ] story [ 39.7 ms ] thread
explain
If you set the nameservers but didn't claim the domain in Cloudflare, then anyone else could claim it and start serving on it. The only real verification that you own the domain is that the nameservers are pointed to Cloudflare.
leoh
That is a serious security issue, then. I could relatively easily check every domain on the net to find domains that use Cloudflare DNS, but do not actually point to any content as a vector to get a free domain. No?

Doesn't Cloudflare require you add some kind of special DNS record or host some kind of special webpage to get things rolling?

leoh
Also, doesn't Cloudflare require a specific pair of DNS name servers in order to assert that someone "owns" a domain?
BandButcher
Yes and no. Idk if they validate you own the domain, i think they just care that your nameservers point to theirs. I recently setup a couple sites in cloudflare and they just asked to set 2 different nameservers on the domain registrar (not namecheap, but spaceship.com). See here: https://developers.cloudflare.com/dns/zone-setups/full-setup...

I had also created my "worker pages" app/project in cloudflare before updating my nameservers in spaceship.

But i do have namecheap domains as well and used firebase hosting (google) and they DID ask to have certain TXT records to be added to namecheap and validated before provisioning my ssl cert.

I'm assuming every provider is different. But yea i would just undo the CF nameserver until you're ready to go live

explain
They do, but the nameserver pairs aren't unique and there aren't that many combinations (2500, apparently).

It would be easy enough to automate the creation of accounts until you have an account for every nameserver pair, then start serving on unclaimed domains.

kentonv
If the nameservers are already pointing at Cloudflare when you try to set up an account, Cloudflare will ask you to set a different pair of nameservers.

I learned this when I was transferring a whole bunch of domains over, and I noticed it kept asking me to use the same nameservers. So I started setting the nameservers in advance of trying to import the domain into Cloudflare, to save a little time. And then... Cloudflare started asking me to use different nameservers, and wouldn't serve content until I did.

So even if you create 2500 accounts trying to claim the same domain, I suspect it will never give you the pair that's already configured, and therefore you won't be able to claim it. I also suspect it won't give any two accounts the same nameserver pair.

(I'm a Cloudflare employee but my knowledge above is only based on my observations as a user; I don't work on this part of the system. I have no idea what actually happened to OP.)

leoh
Right. This would be my hypothesis. Something really bad happened here, imo, and I am really boggled as to why the heck it would happen. It's possible that if you create enough accounts, you'll get one where the pair of nameservers will coincidentally line-up with some domain's nameserver configuration.
KomoD
> Doesn't Cloudflare require you add some kind of special DNS record or host some kind of special webpage to get things rolling?

No.

remram
Let me check if I got this right, you pointed your website to somebody else's server (CloudFlare), without telling them about it or having any sort of account or relationship with them?
KomoD
> I checked the DNS and I had set the nameservers to Cloudflare, but had never used Cloudflare for hosting.

Basically someone else just claimed your domain on Cloudflare? Fuck up on your end.

I did it too, I bought a domain, switched the nameservers but forgot to claim it in my account, someone else claimed it and then I just switched the nameservers again

> I tried submitting an abuse form to Cloudflare, but their automated form claimed they did not manage the domain

I don't know why you did that, and yeah what they said was probably true, they don't host (except for workers & pages), they just do DNS or proxy

> And what recourse do I have, if any?

None? You're responsible for your domain