xxdesmus

I run Trust & Safety at Cloudflare.

The best route to request a takedown of this domain and luaventures{.}xyz (the other domain mentioned in your blog post) would be at the host and/or the domain registrar. Cloudflare isn't the host or registrar these domains. We have no capacity to take down content hosted by others.

I run the trust & safety team at Cloudflare.

In the vast majority of cases, Cloudflare is not the hosting provider of a website resolving to our IPs. In those cases we have no capacity to remove content hosted by others. In those cases we can place a phishing warning page (like Google safe browsing) to warn and educate users that they were nearly phished. If we simply terminated a website it would not remove the content, and the user wouldn’t learn or realize they almost just got phished. It’d be the worst of both worlds. In the rare case where we are the host we place a non-bypassable block in front to make protect users.

While Cloudflare has been publishing transparency reports for a long time, this year we chose to revamp the report in light of new reporting obligations under the DSA, and our goal of making our reports both comprehensive and easy to understand. Before you dive into the reports, learn more about Cloudflare’s longstanding commitment to transparency reporting and the key updates we made in this year’s reports.

1H and 2H 2024 reports are now live.

Please drop me an email with what you’re seeing - justin (at) cloudflare.com ?

That doesn’t sound like old info - that sounds like someone might still be reporting it for abuse even after the domain changed owners.

I look forward to the phishinhg. Hopefully you can block known bad hashes.

1) Thanks for the heads up 2) Is this the beta channel? or official builds? 3) You've already notified 1Password of this possible bug/risk?

Self hosting option? Looks great, but I’d rather avoid a SaaS service if possible.

CNAME flattening works just fine and is supported by a variety of DNS providers at this point, but yes — there’s an RFC otherwise.

Hello,

I’m the Head of Trust & Safety at Cloudflare. I wanted to clarify our processes, which were described inaccurately in this Hacker News post.

As part of our standard fraud review process, domains determined to be malicious registrations/transfers may be deleted. In those cases, we typically take steps to notify the account holder so that they can contest the determination if appropriate. Cloudflare allows transfers of domains out of Cloudflare’s registrar immediately, unless there are indications of potentially malicious or fraudulent activity. Cloudflare follows the standard industry practice followed by virtually all domain registrars of blocking the transfer out of domains deleted for what appears to be potentially malicious purposes.

Hello, I'm the Head of Trust & Safety. Please forward me the email? This is very likely legitimate and from our team, but I'd like to confirm. justin@ cloudflare.com

Cloudflare sends the origin IP directly to the hosting provider -- with a copy of the abuse report.