Disaster Cloudflare News Megathread

The Mass Shooter Ron Soye · Nov 22, 2025

TorrentFreak: Piracy Liability Dispute Between Universal Music and Cloudflare Reaches EU’s Highest Court (archive) (mega)

November 21, 2025 11:20:32 UTC by Ernesto Van der Sar

A legal battle that began over a Sarah Connor album posted on a German pirate site has escalated into a landmark case that will shape EU copyright law. The lawsuit between Universal Music and Cloudflare has reached the highest German court, which recently asked the EU's top court to step in. At stake is the legal definition of "temporary caching" and whether CDNs face the same liability risks as content platforms.

Pirate sites have proven to be quite a headache for Cloudflare and have landed the San Francisco-based tech company in court on several occasions.

These legal battles include a case in Germany, where the local branch of Universal Music sued Cloudflare for offering its services to pirate site DDL-Music.

The origins of this case date back to June 2019, when the German branch of Universal Music sent a copyright infringement notice to Cloudflare, listing DDL-Music links, which in turn linked to third-party sites that hosted tracks from Sarah Connor.

The lawsuit didn’t make any headlines, at least not initially. But when Cloudflare displayed an ‘Error 451’ to DDL-Music users in early 2020, it was clear that something was up. Error 451 is still relatively rare and typically reserved for cases where content has been made inaccessible for legal reasons.

In this case, Universal had obtained a preliminary injunction against Cloudflare that required the company to stop providing its CDN services to the pirate site. Failure to comply could’ve invoked a fine of up to 250,000 euros or even a six-month prison sentence for Cloudflare’s managing director.

Cloudflare was disappointed with the outcome and decided to appeal. The case eventually made its way to the Cologne Higher Regional Court, which largely confirmed the liability finding in 2023. That was another setback for Cloudflare which appealed to Germany’s highest court.

High Stakes, Highest Courts

The Federal Court of Justice (Bundesgerichtshof) took on the appeal in what has become a landmark case. The Court’s ruling is expected to be leading when it comes to the liability of CDN services for the copyright-infringing actions of customers.

Realizing the potential for broad repercussions, Germany’s highest court is actively seeking advice from the EU’s highest judicial body: the Court of Justice of the European Union (CJEU).

Specifically, it asks the EU’s top court to provide guidance on two key questions that affect the potential liability of linking sites and CDN providers.

The questions were formally submitted earlier this year and were posted in the Official Journal of the European Union this week.

The referred questions

Q1: Storing vs. Linking?

The German questions were translated into English and other languages, but not in a way that they are easy to grasp for the public.

Question 1: Can an act of making a phonogram available to the public within the meaning of Article 3(2)(b) of Directive 2001/29/EC (1) be carried out only by persons in whose own access sphere the protected recording is located? Or can such an act of making a phonogram available to the public be carried out by posting a hyperlink – and, if so, under what conditions?

The first question touches on the linking vs. hosting argument that’s common in piracy disputes. In this case, DDL-Music did not host the music files itself. Instead, it provided links to third-party cyberlockers like Nitroflare.

The German judges seem conflicted about the definition of copyright infringement when it comes to linking.

Generally speaking, the German Federal Court operates under the assumption that to “make a work available” to the public, the infringer must have control over the file within their own “access sphere” (e.g. their website/server).

However, there are also EU rulings that found linking can sometimes constitute a “communication to the public” and the German court asks the CJEU to clarify: Can a site operator be liable for “making a phonogram available” if they simply hyperlink to it?

Q2: Hosting or Caching?

The second question is arguably even more complex and harder to grasp. Not just due to the legal jargon, but also because of the implications concerning the liability of CDN providers.

Question 2: Are the criteria developed by the Court of Justice of the European Union as regards an act of communication to the public, pursuant to Article 3(1) of Directive 2001/29/EC, by the operator of a video-sharing platform or share-hosting platform to be applied also when assessing the question of whether the operator of a content delivery network, who may be exempted from liability pursuant to Article 13(1) of Directive 2000/31/EC (2) or Article 5(1) of Regulation (EU) 2022/2065, (3) has carried out its own separate act of making available to the public pursuant to Article 3(2) of Directive 2001/29/EC? If the foregoing question is answered in the negative: What criteria are to be applied for the purposes of determining whether the operator of a content delivery network carries out its own separate act of making available to the public?

With the second question, Germany’s Federal Court seeks clarification on the legal status of Cloudflare’s CDN infrastructure. It effectively asks if it classifies as a hosting provider or a caching service.

Cloudflare sees its CDN mostly as a caching service, which operates as a neutral intermediary that should not be liable for the bits that it passes on. Universal Music, however, disagreed and pointed out that some files are cached by Cloudflare for up to a year.

If Cloudflare is seen as a hosting service, Germany’s Federal Court would like to know if the liability criteria previously determined in the landmark YouTube vs. Cyando case also apply here.

In that matter the CJEU ruled that platforms such as YouTube are not liable for pirated content uploaded to their service. Liability only comes into play if a service actively and deliberately contributes to the infringement.

Finally, if the YouTube standards don’t apply, the German court wants to know exactly what criteria should be used to determine if a CDN is directly liable for the pirated content it delivers.

Going forward

The questions are now in the hands of the CJEU, which is expected to share its view on the matter next year. Given the stakes involved, the matter will be followed closely by Internet infrastructure providers and rightsholders alike.

The final verdict is also expected to provide more insight into a technical debate regarding “Time to Live” (TTL) caching settings.

In its referral order, the German court noted that while Cloudflare’s servers could theoretically cache a file for a year or longer, this doesn’t necessarily mean the company has abandoned its role as a neutral intermediary.

The German judges appear open to the idea that “temporary” storage shouldn’t be measured in time, but by its function. If a file is stored for a long time purely to improve loading times or security, it might still qualify as “caching” rather than “hosting”.

However, if the CJEU decides that long-term storage is indeed active hosting, Cloudflare could lose its liability shield. This would effectively require CDN services to make sure that content hosted (or linked) by customers is rendered inaccessible when rightsholders complain.

The Mass Shooter Ron Soye · Nov 23, 2025

TorrentFreak: Cloudflare Says Piracy Liability Ruling Has Global Implications; Publishers Disagree (archive) (mega)

November 23, 2025 10:08:29 UTC by Andy Maxwell

A ruling by a Tokyo court which holds Cloudflare liable for manga piracy is serious and could have global implications, the company says. Filed by manga publishers in 2022, the lawsuit criticized Cloudflare for providing services to the sites, despite the publishers' allegations. Cloudflare says the ruling undermines fairness and due process, but speaking with TorrentFreak, the publishers strongly disagree. They say their aims are straightforward, and the outcome is aligned with Cloudflare's pledge to combat piracy.

Services offered by U.S tech giant Cloudflare improve the performance and security of millions of websites, amounting to a significant contribution towards the health of today’s internet.

Those hoping to benefit from Cloudflare’s services find few, if any, barriers to entry. Typically a working email address is sufficient to gain access, meaning new users can protect their websites in a matter of minutes.

Cloudflare Held Liable For Anonymous Users

Frictionless onboarding is popular with users and good for Cloudflare’s overall business. For Japanese manga publishers Shueisha, Kodansha, Kadokawa, and Shogakukan, the absence of identity verification is a gift to pirate site operators. Not only are they allowed to remain personally anonymous, their websites’ IP addresses can be hidden and exchanged for Cloudflare’s, making enforcement more difficult.

A decision handed down this week by Judge Aya Takahashi at the Tokyo District Court, holding Cloudflare liable for infringement carried out by its customers, concerns a lawsuit filed by the publishers in 2022.

The companies said that the anonymity afforded by Cloudflare to site operators and their websites, provides an attractive environment for piracy of their content to thrive. When the publishers’ repeatedly complained, Cloudflare should’ve taken the strongest of action against such abuse, including terminating the accounts of known pirate sites.

Liability and Future Growth

Judge Takahashi agreed that the lack of identity verification was a piracy-enabling factor but Cloudflare’s inaction amounted to a failure to acknowledge responsibility.

“(Cloudflare) failed in its duty to stop providing the service,” Judge Takahashi said.

Liability in this instance led to a damages award against Cloudflare of 500 million yen, around US$3.2 million. In the bigger picture, the money is less important to Cloudflare than new liability and what that might mean for the growth of its business.

In this instance, the court did not issue an injunction to restrain Cloudflare moving forward. However, the finding of liability is unacceptable to Cloudflare so it intends to file an appeal and continue the fight.

“We appreciate the efforts of the Tokyo District Court, which spent a great deal of time and effort reviewing and ruling on this complex case. While we respectfully disagree with the court’s decision, we also express our dissent,” the company said in a statement sent to legal news outlet Bengo4.

Cloudflare maintains its long-held position that as a CDN, it delivers data and doesn’t host anything. Since the pirated content is hosted elsewhere, that’s where it will remain, regardless of any action at Cloudflare.

Cloudflare Ups the Stakes, Warns of Global Implications

Cloudflare’s pursuit of a decision aligned with its own interests, will see the publishers defend their hard-won position with similar determination. For the former, the decision in Japan isn’t just a local storm, it’s a threat to intermediaries and sets a global precedent with far-reaching implications.

“Holding CDNs like Cloudflare legally liable for content they do not host removes the limitations on liability that have underpinned the growth of the global internet. This ruling is the first of its kind in the world and could have serious implications for the efficiency, security, and reliability of the internet not only in Japan but around the world,” the company says.

While a robust defense of its position is to be expected, Cloudflare seems to be especially vocal – and critical – not just of the decision, but how it will hurt Japan’s progress moving forward.

Describing the ruling as “undermining transparency, fairness and due process,” Cloudflare said the trial questioned whether Japan’s judicial system supports its aspirations for growth in tech.

“This ruling is contrary to the legislative intent of promoting Japan’s technological growth and risks stifling technological innovation among Japan’s emerging technology companies,” Cloudflare added.

If the decision stands, to avoid liability Cloudflare says it would need to terminate CDN services based on takedown notices, rather than under the formal instructions of a competent court.

The Publishers’ View the Decision in a Different Light

Yuki Hirai is an attorney at Sakurazaka Law Office, where he leads the case on behalf of the publishers.

In recent comments to the USTR, Cloudflare suggested that a negative outcome against the publishers would “necessitate U.S. CDN providers to limit the provision of global services.”

In comments to TorrentFreak, Attorney Hirai disputes that, noting that Cloudflare’s argument “distorts the essence” of the case.

“This ruling concerns responsibility for providing high anonymity and ignoring infringement notices, not the provision of the service itself nor other CDN service provider,” he explains.

“Cloudflare also argues that to avoid their legal liability, it would need to suspend CDN services for a website based on a notice rather than a formal order from an independent court, significantly increasing the potential for abuse. However, this judgment states, citing several reasons, that our infringement notice properly shows the URLs to the infringing content, and that upon viewing those URLs, it was immediately obvious they were pirate sites.”

Attorney Hirai says Cloudflare’s arguments are “highly self-defensive and contain numerous errors.” The publishers true aims are actually quite straightforward.

A Decision That Aligns With Cloudflare Policy

“What we are demanding is a very general act of ceasing to aid such crimes. Restricting the provision of global services is not the solution we seek, nor is it aligned to this judgement,” Hirai explains.

“What we are seeking is for Cloudflare to promptly cease providing services once the sites are notified as pirate sites, and to implement appropriate measures such as identity verification to prevent repeat infringers.

“These requests from us also align with Cloudflare’s policy in its statement to media outlets, of ‘not hesitating to cooperate in combating piracy’”

Terrifik · Nov 23, 2025

Devil Advocate post: the company is too big to fail & backbone of the internet.
-We are at lawsuit arc to have them censor sites with lawsuit-

https://x.com/MonetizeXWithAb/status/1990812806720135254?s=19

The Mass Shooter Ron Soye · Nov 24, 2025

July 18, 2025: Insider Monkey: Jim Cramer on Cloudflare: “The Stock Should Be Bought Even Up Here” (archive)

“Yeah, I thought it was brilliant. I thought Matthew Prince was brilliant. I think NET’s great. I’ve been behind this for, since probably for about 120 points. I think Matthew’s about as good as it gets, and the stock should be bought even up here.”

The kiss of death.

Terrifik said:
Devil Advocate post: the company is too big to fail & backbone of the internet.
-We are at lawsuit arc to have them censor sites with lawsuit-

I think Cloudflare's ability to protect controversial and piracy websites is diminishing, and they cooperate with authorities more than they let on. Meanwhile, they make decisions and mistakes that can negatively affect a large chunk of the Internet, 20% of live websites according to this article.

They will become more evil over time, and they are already analyzing everyone who connects to their portfolio of websites to determine bot/scraper traffic. That's a recipe for deanonymization.

The Mass Shooter Ron Soye · Dec 6, 2025

A faggot from any angle... it's almost like a Marvel movie.

Wired: Cloudflare Has Blocked 416 Billion AI Bot Requests Since July 1 (archive)

Lily Hay Newman
Dec 4, 2025

Cloudflare CEO Matthew Prince claims the internet infrastructure company’s efforts to block AI crawlers are already seeing big results.

Cloudflare CEO Matthew Prince

As the large language models powering generative AI tools slurp up ever more data across the web, Cloudflare cofounder and CEO Matthew Prince said at WIRED’s Big Interview event in San Francisco on Thursday that the internet infrastructure company has blocked more than 400 billion AI bot requests for its customers since July 1.

The action comes after the company announced a Content Independence Day in July—an initiative with prominent publishers and AI firms to block AI crawlers by default on content creators’ work unless the AI companies pay for access. Since July 2024, Cloudflare has offered customers tools to block AI bots from scraping their content. Cloudflare told WIRED that the number of AI bots blocked since July 1, 2025 is 416 billion.

“The business model of the internet has always been to generate content that drives traffic [to a website] and then sell either things, subscriptions, or ads,” Prince told WIRED’s executive editor, Brian Barrett. “What I think people don't realize, though, is that AI is a platform shift. The business model of the internet is about to change dramatically. I don't know what it's going to change to, but it's what I'm spending almost every waking hour thinking about.”

As a company, Cloudflare’s offerings are geared toward making it faster and safer to access content online. But as the AI industry has exploded and AI giants have emerged, Prince says he’s become increasingly focused on how Cloudflare can leverage its position to discourage consolidation and safeguard the internet as a place where businesses and creators of every size can survive—or, ideally, thrive.

“We need to be able to make sure that businesses large and small flourish on a fair playing ground,” Prince said. “That is the future that we're trying to play for. That's the best thing for our business, because that's more people to be customers of ours. That's more internet for us to be able to protect.”

Prince specifically highlighted concerns about Google’s policies around its search and AI crawlers. As a major AI player jostling for dominance, Google combined its search and AI crawlers into one, so blocking its AI scraper also blocks a site’s ability to be indexed in Google search. The move has put content creators in a bind, because they don’t want AI models to train on their creations, but they typically need their place in Google search to help audiences find their material.

“You can't opt out of one without opting out of both, which is a real challenge—it's crazy,” Prince said. “It shouldn't be that you can use your monopoly position of yesterday in order to leverage and have a monopoly position in the market of tomorrow.”

Prince cites stats that Cloudflare has not previously shared publicly about how much more of the internet Google can see compared to other companies like OpenAI and Anthropic or even Meta and Microsoft. Prince says Cloudflare found that Google currently sees 3.2 times more pages on the internet than OpenAI, 4.6 times more than Microsoft, and 4.8 times more than Anthropic or Meta does. Put simply, “They have this incredibly privileged access,” Prince says.

Publishers and other content creators have seen promising results when they block AI crawlers, Prince adds. He argues that creative, original human thought still has immense potential value and urgency for AI companies looking to ever-expand their models, whether these insights come from local news outlets that know all the regional details or Reddit users brain dumping their deepest—or silliest—ideas. And this creates the potential for licensing deals and other paid content to be at least the germ of a viable business model for creators long term.

Ultimately, Prince notes that regulation may be a necessary intervention. In the meantime, Cloudflare is working to apply pressure wherever it can to drive evolution of AI business models that are pluralistic and expand markets, rather than concentrating and centralizing them. Prince argues that while this aligns with founding tenets of the open internet, it’s also just good business for everyone.

“It's almost like a Marvel movie—the hero of the last film becomes the villain of the next one,” he said. “Google is the problem here. It is the company that is keeping us from going forward on the internet, and until we force them—or hopefully convince them—that they should play by the same rules as everyone else and split their crawlers up between search and AI, I think we're going to have a hard time completely locking all the content down.”

Fred Fuckstone · Dec 8, 2025

According to Gelbooru, Cloudflare has outsourced the decisions of whether content is legal to a German "self regulator" association that works with the government called FSM (Freiwillige Selbstkontrolle Multimedia-Diensteanbieter).

I take this with a massive grain of salt because these people had a meltdown with their hosting company over them wanting Gelbooru to purge all of the lolicon from their site, and the specific quote they reference is in regards to whether or not a CSAM report is valid and does not give any more information such as the site in question or if it's even US based.

(Gelbooru wound up compromising by requiring users to enable objectionable content like e621, however at least the furries require you to make an account to do so as people who aren't logged in can still enable it)

https://archive.is/4ZMlB

pikachudidnothingwrong · Dec 8, 2025

Fred Fuckstone said:
According to Gelbooru, Cloudflare has outsourced the decisions of whether content is legal to a German "self regulator" association that works with the government called FSM (Freiwillige Selbstkontrolle Multimedia-Diensteanbieter).

View attachment 8263259

https://archive.is/4ZMlB

Insane and scary if true.. These are places that ban so much speech and expression.. From mature content to political.

Their X account claims (nitter) they have been in contact with @Null about this or something. (drawing a few randos to drive by and screech lol) Any news, details or updates you know of?

Someone needs to file complaints with the US gov if this turns out to be even partly true.

The Mass Shooter Ron Soye · Dec 8, 2025

pikachudidnothingwrong said:
Someone needs to file complaints with the US gov if this turns out to be even partly true.

German quasi-governmental entity sends info to Cloudflare, Cloudflare acts on it. There isn't likely to be any recourse.

"Immediate threat to human life!"

The Mass Shooter Ron Soye · Dec 11, 2025

TorrentFreak: Scammers Mimic Cloudflare’s ‘Error 451’ Site Blocking Notice to Infect Pirates (archive) (mega)

December 11, 2025 10:35:11 UTC by Andy Maxwell

Earlier today we saw fairly compelling evidence that blocking pirate sites can lead to internet users being infected with malware. Apparently inspired by Cloudflare's use of HTTP Error 451, which greets pirates when attempting to visit sites blocked in the UK, unknown actors mimicked Cloudflare's site blocking page and then attempted to trigger malicious scripts.

Anti-piracy groups provide regular reminders that pirate sites expose users to malware and related security risks. In some cases, no action is required for users to come to harm, all they have to do is visit a malicious site.

While not the most common route of infection, under the right circumstances that can indeed happen. Yet something we saw for ourselves this week may go even further than that.

When blocking measures are deployed against dozens of sites, there’s a period of uncertainty in which many pirates are traditionally less cautious about visiting alternative sites. For those who benefit from internet users clicking first and thinking later, there’s arguably no better time to target pirates. In the context of recent developments, targeting pirates before they even set foot on a pirate site, using a distraction they may already be familiar with, is something we haven’t seen before.

So why now?

Fewer Options For UK Pirates

Around early September, Cloudflare suddenly began blocking pirate sites in the UK. Cloudflare’s unique position in the market is certainly not lost on the major movie and TV studios, and it’s a matter of record that they view voluntary cooperation as the best way forward.

What prevented Cloudflare from digging a trench in opposition to site-blocking hasn’t been revealed. However, since adversarial cases at the High Court tend to get quite noisy, and Cloudflare appears to have been added to existing, long-running blocking injunctions rather more quietly, something else may have happened.

If the instructions are the same as those issued to ISPs, Cloudflare’s blocking targets include dozens of branded pirate streaming sites, in some cases clustered under common control or ownership, plus the countless domains they have already deployed and are yet to deploy, to circumvent UK site blocking measures.

Exploiting The Fallout from Blocking Measures

During mid-November, an existing blocking injunction was updated with the addition of approximately 150 fully qualified domain names (FQDNs), which precisely identify resources using their hostnames, domain names, and top-level domains. The ‘pirate brands’ involved are as high profile as they come: Sflix, GoMovies, 123movies, Solarmovies, Fmovies, Soap2Day, Hurawatch, and Bflix, plus more recent upcoming brands such as Boomflix and Moonflix.

Early this month, a notice from the MPA referencing High Court injunction application IL-2021-000027 was posted by Cloudflare to the Lumen Database. Originally granted in 2021, a note on Lumen suggests that the High Court issued an order on December 8, 2025, presumably to formalize Cloudflare’s role in blocking associated domains.

While we were carrying out tests and making inquiries to determine Cloudflare’s response, a familiar notice appeared in connection with a domain that felt familiar. In the company of Sflix, MyFlixer, Bflix and Flixbaba, Flixerplus stood out no more than Cucuflix or Flixmomo.

For UK pirates tired of ISP blocking, now with added Cloudflare and the joy of intermittent VPN blocking on top, it may even represent hope. Unfortunately, the notice below suggests otherwise.

Error 451 – Unavailable for Legal Reasons?

Aside from some unusual additional characters, the Error HTTP 451 notice is similar to previous blocking notices published by Cloudflare for the same reasons. A cautious hover over the link to the order on the Lumen Database revealed nothing untoward either.

Yet, near the bottom, why would Cloudflare “Thank you for your !” ?

Not a Cloudflare Notice, But a Serious Distraction

While the Flixerplus domain has a relatively small online footprint, it’s not new. This means it doesn’t trigger precautionary security features that deny access to DNS for newly registered domains. The WHOIS records raise no alarms either.

The 451 notice being served over HTTP, instead of HTTPS, is a big red flag, however. The same goes for the questionable domains the site attempts to access in the background, and what appears to be an iframe loading a script (or scripts) from an external source. As far as we can tell, regular anti-virus vendors have yet to detect this.

URLScan reveals some of the broader picture. URLQuery reveals that the same attack also exists elsewhere, in connection with similarly branded sites.

DNS providers have already taken action against an underlying network, but whether that will have enough impact is currently unknown.

At the time of writing, Cloudflare has not responded to our request for comment. As for Flixerplus, it may stick around for a while. Unlike the domains Cloudflare will likely be required to block, Flixerplus doesn’t appear to be listed for blocking in the UK, or indeed anywhere else.

Rootless Cosmopolitan · Dec 11, 2025

Terrifik said:
Devil Advocate post: the company is too big to fail & backbone of the internet.
-We are at lawsuit arc to have them censor sites with lawsuit-

View attachment 8206766 View attachment 8206824

https://x.com/MonetizeXWithAb/status/1990812806720135254?s=19

I think it’s really only AWS and Cloudflare, plus the undersea cables and satellites. The cables are pretty much wholly unsecured and the satellites are there for anyone to track and shoot down at will. If we do get in a war, the global internet will quickly be fragmented

Markass the Worst · Dec 20, 2025

We all know what kinds of sites Matthew Prince is willing to host: A zoophile site, a pro-pedophile site, multiple child pornography sites. Send all the abuse reports you want, but Cloudflare does nothing about them.

Meanwhile, you know the one site Cloudflare will suspend quickly? A site that lets people know if their privacy has been violated, i.e. their license plate got read by shitty, "AI"-powered Flock cameras.

Flock and Cyble Inc. Weaponize "Cybercrime" Takedowns to Silence Critics

When a government contractor pays a company for "Takedown Services" to prevent transparency in government
December 16, 2025 by H.C. van Pelt

Cyble Inc., a firm marketing itself as a service to “Disrupt Cybercrime,” recently attempted to disrupt something else entirely: government accountability.

Cyble, claiming to act on behalf of Flock, filed a series of demonstrably false abuse reports with our hosting provider, Cloudflare, to scrub this site from the internet. Their strategy? Accuse us of “phishing” and “trademark infringement” to hide the information we publish.

The Evidence

Here is the text of the actual report Cyble filed against us:

Report ID: 440e11…
Logs or other evidence of abuse: The mentioned website is wrongfully using our client’s registered trademark in the fake web page. The use of the Client’s registered trademark descriptively in the reported URL in order to disguise or phish the general public has not been authorized by our client. The website publicly and deliberately releases extensive, sensitive information obtained from Flock.
Reported URLs: hxxps://haveibeenflocked[.]com/
Below are the report submitter’s details:
Submitter’s Name: Thomas Siah
Submitter’s Email Address: response@cyble.com

Throwing Mud at the Wall

Looking at the report, it is difficult to tell what the actual complaint is.

Are we infringing on a trademark?

Are we running a “fake website”?

Are we “disguising or phishing the general public”?

Or is the real issue that we are publishing public records—which they falsely claim were “obtained from Flock”—that expose the rampant abuse of Flock’s mass surveillance platform?

Cyble’s representative, Thomas, is simply making every allegation possible in the hope one will stick, regardless of the evidence. Apparently, filing false reports against critics is a winning strategy for them.

Update: Cloudflare Responds

Hedwig (Cloudflare)

Dec 18, 2025, 9:16 AM PST

To Whom It May Concern:

If you can show this information is publicly available and/or shared with the consent of the person, please provide us with a link to the original public sources or documentation verifying this consent.

Regards, Cloudflare Trust & Safety

What “this information” refers to, or how showing the sources (which are available here) would help establish this is not a phishing website is anyone’s guess.

We Aren’t Going Anywhere

Ultimately, this is a minor inconvenience. It took me about an hour—after I finished playing my video game[1]—to change the code and migrate the site off Cloudflare’s infrastructure.

The suspension has been appealed, but we aren’t waiting for permission to exist.

Update: The site has been fully moved over. If we are blocked again it should be straightforward to move anywhere.

Come hang out on Discord with other people who believe in oversight, accountability, and the rule of law.

We will continue to expose Flock for what it is: a company so contemptuous of civil liberties that its CEO will paint active citizenship as terrorism, and now, apparently, cybercrime.

With the new Divinity game in the works, I decided to do a run as Gale in BG3. ↩︎

source (a)

Google.com · Dec 20, 2025

Markass the Worst said:
Meanwhile, you know the one site Cloudflare will suspend quickly? A site that lets people know if their privacy has been violated, i.e. their license plate got read by shitty, "AI"-powered Flock cameras.

Thank you cloud flare. I despise Flock and have never heard about this website.

MetokurGroomedMe · Dec 20, 2025

what an incredibly useful, streisand-like effect we have ourselves here. i had never heard about flock or haveibeenflocked.com but now that i know, thanks to cyble's gracious work making the public aware, i'm going to go use it and spread it to every circle i'm part of. thanks to you too, markass. kino poster at all times.

Jotch · Dec 20, 2025

This is how I discovered the farms. Looking forward to a more unified approach against mass surveillance coming about from this.

The Mass Shooter Ron Soye · Dec 20, 2025

Phoronix: GotaTun Open-Source Rust WireGuard Implementation Announced By Mullvad (archive)

Michael Larabel on 20 December 2025

The Swedish VPN service Mullvad announced this week GotaTun, an open-source Rust-based WireGuard implementation that is forked from Cloudflare's BoringTun.

BoringTun was open-sourced by Cloudflare back in 2019 as a Rust-written, user-space WireGuard implementation for Linux and other platforms. GotaTun integrates additional functionality like DAITA and Multihop compared to Cloudflare's BoringTun code, thus the fork. There is also "first class" Android support and other differences with GotaTun. Previously Mullvad was relying on a Go language implementation of WireGuard.

With the WireGuard Go implementation they had encountered crashes while so far "not a single crash" has been detected with GotaTun.

In 2026 the GotaTun software will see a third-party security audit, replace WireGuard-Go with GotaTun across all platforms for the Mullvad VPN usage, and other performance improvements.

Those wanting to learn more can do so via the Mullvad.net announcement and the open-source code on GitHub.

TorrentFreak: Video Game Giants Suddenly Have RuTracker in their Crosshairs Again (archive) (mega)

December 21, 2025 10:10:46 UTC by Andy Maxwell

RuTracker is not only Russia's largest torrent site, it's one of the oldest and most resilient pirate sites anywhere in the world. Most major entertainment companies have had issues with RuTracker at some point during its 21 years online, and those in the videogame sector are no exception. Under the umbrella of The ESA, some of the largest are now showing renewed interest in the torrent site veteran.

There are only a few torrent sites still alive today that can boast more than 20 years online, yet only two – The Pirate Bay and RuTracker – have managed that feat under perpetual public scrutiny.

A little younger than its Swedish counterpart and on balance, a survivor of fewer wars, RuTracker has nevertheless lived through domain seizures (its torrents.ru domain was lost in 2010) and intense site-blocking measures both in Russia and multiple countries overseas.

No Particular Enemies, Just Most Rightsholders, Generally

Much like The Pirate Bay, RuTracker has also featured in countless critical rightsholder reports submitted to various authorities. Offering content across most categories means that the majority of large entertainment industry groups have had a problem with RuTracker at some point over the past two decades.

At the time of writing, UK music industry group BPI leads the pack on search engine takedowns; it has targeted almost 287,000 URLs on the site’s .org domain, the most recent just 10 days ago.

Despite having sent in excess of 26,000 URL takedown notices against RuTracker’s main domain alone, the Entertainment Software Association’s notices lag behind those sent by the music industry; since it has vastly fewer individual videogames to protect than the labels have music tracks, that’s to be expected.

Nevertheless, the RuTracker problem is significant and stubbornly persistent; no doubt the ESA’s members would like this issue to reach a favorable conclusion, sooner rather than later.

ESA member list

After placing greater emphasis on relatively young gaming-focused piracy platforms over the last couple of years (FitGirl-Repacks, Dodi-Repacks, nsw2u.com) the ESA’s October submission to the USTR contained just one paragraph about RuTracker.

By now the background is understood, and the numbers tend to speak for themselves, but a new development this week suggests that the ESA may be interested in breaking the status quo.

DMCA Subpoena to Cloudflare

At the US District Court for the District of Columbia this week, counsel for ESA requested a subpoena pursuant to 17 U.S.C. § 512(h), commonly known as a DMCA subpoena. The target was Cloudflare and the complaint concerns the unlicensed distribution of ESA members’ copyrighted works via RuTracker.

The requested subpoena and the required DMCA notification to Cloudflare are both dated December 16 so it’s unclear whether Cloudflare had the opportunity to review the notice in advance. Since Cloudflare can’t remove individual links, a detailed link-by-link review may not routinely take place. In this case, however, any review would involve guesswork, apart from in one or two isolated cases.

The ESA notice contains a list of videogame titles and nothing else. The table below contains the titles and additional information added by us for reference, but where to find the infringing links is entirely absent.

There’s no hard requirement to specify the precise location of content in a DMCA notice, and a representative list of titles is fine too, but websites published in Russian and guesswork tend not to mix. It may be a sign that there’s no expectation of anything being taken down, which wouldn’t be at all misplaced.

ESA Wants to Track Down RuTracker’s Operator

In its notification to Cloudflare, the ESA strongly implies that the conduct of RuTracker’s operator may not be in keeping with Cloudflare’s terms of service. It stops short of demanding cessation of business but then follows up with a reminder.

The communication is meant to facilitate removal of the infringing material, not “suggest or imply that Cloudflare’s activities and services are within the scope of the DMCA safe harbor.”

More immediately, the ESA hopes that Cloudflare is able to provide the following:

Whether anything useful will emerge from the considerable volume of data held by Cloudflare remains to be seen but after 21 years of evading copyright holders, nothing can be ruled in – or ruled out.

ESA’s DMCA subpoena application and supporting documents are available here 1,2 (pdf)

The Mass Shooter Ron Soye · Dec 28, 2025

TorrentFreak: Cloudflare Reports Surge in Streaming Piracy Takedowns, Removes 20k+ Storage Accounts (archive) (mega)

December 28, 2025 16:38:25 UTC by Ernesto Van der Sar

Cloudflare’s latest transparency report reveals a massive 3,800% surge in copyright-related takedown actions, fueled by a shift to more automated enforcement. By granting rightsholders direct API access, the company says that it was able to target live sports streaming piracy more effectively. This resulted in the termination of over 20,000 R2 storage accounts in just six months.

As one of the leading Internet infrastructure companies, Cloudflare finds itself at the center of various copyright disputes.

The American company says it powers nearly 20% of the web. This includes several Fortune 500 companies, but also many pirate sites and services.

For years, rightsholders have urged Cloudflare to do something about these pirate sites. However, the company typically doesn’t take action against customers that use its CDN services. Instead, it simply forwarded takedown notices to their respective hosting services.

If customers do use hosting-related Cloudflare services, they will have their content removed. These types of customers have increased significantly over time, and this year, Cloudflare reports a significant spike in takedown activity.

3,800% Increase in Takedowns

Cloudflare’s latest Transparency Report, published last week, shows that the company received 124,872 hosting-related copyright complaints in the first half of 2025. Of these reports, 54,357 resulted in Cloudflare taking action, presumably by disabling or removing the content in question.

These figures represent a dramatic year-over-year increase, as Cloudflare reported ‘only’ 1,394 copyright-related takedown actions in the six months prior. That’s an impressive 3,800% increase.

If we zoom out further, we see that the hosting-related reports and takedowns have grown steadily over the years.

Evolution of Cloudflare’s copyright actions

Period	Reports Received	Reports Actioned
2023 H1	376	252
2023 H2	1,111	1,078
2024 H1	10,892	1,046
2024 H2	11,508	1,394
2025 H1	124,872	54,357

Source: Cloudflare Transparency Report Data / TorrentFreak

The most recent spike is not merely the result of increased hosting activity, however. Cloudflare notes that it started to actively engage with rightsholders in the first half of the year to tackle unlicensed sports streaming.

Rightsholders Get API Access

Justin Paine, Cloudflare’s Vice President of Trust & Safety, notes that this increase is partly the result of a shift toward more automated processes. Specifically, the company offered rightsholders access to a dedicated API, designed to streamline the submission of copyright complaints.

Through the API, rightsholders were able to automate takedown requests. This resulted in a higher takedown volume and a lower median reaction time, which is key when dealing with time-sensitive content such as live sports streams.

“This engagement resulted in a significant increase in both reports of streaming and corresponding DMCA takedown actions on hosted content, which jumped from 1,394 to 54,357,” Cloudflare’s transparency report reads.

This collaboration and the newly gained insights further boosted the enforcement efforts and resulted in actions against thousands of Cloudflare R2 storage accounts. In the first half of 2025, Cloudflare terminated 21,218 accounts, of which 19,817 were processed automatically.

Increased Blocking & DNS at Risk

Site blocking also remained a hot topic. In response to various court orders or regulatory authorities, Cloudflare has also geo-blocked access to several domains that use its CDN pass-through services. It is clear that the blocking pressure is mounting, with most requests coming from France.

CDN blocking orders

Cloudflare typically does not meddle with its DNS resolver. Instead, it geo-blocks requests for these domains. The transparency report doesn’t mention any data regarding DNS blocking orders and notes that DNS-based blocking will be avoided at all costs.

“Cloudflare has pursued legal remedies before complying with requests to block access to domains or content through the 1.1.1.1 Public DNS Resolver or identified alternate mechanisms to comply with relevant court orders.”

“To date, Cloudflare has not blocked content through the 1.1.1.1 Public DNS Resolver,” the transparency report adds.

Clunky Blocks & UK Cooperation

In addition to being subject to direct orders, Cloudflare services are also blocked by third parties. For example, ISPs in Spain and Italy were required to block Cloudflare infrastructure to comply with IP-address blocking actions targeted at illegal sports streams.

Commenting on these efforts, Justin Paine specifically calls out the Spanish football league LaLiga for its “clunky” blocking approach and its “unapologetic” stance.

“The disproportionate effect of IP address blocking is well known. LaLiga has nonetheless been unapologetic about causing the blocking of countless unrelated websites, suggesting that their commercial interests should trump the rights of Spanish Internet users to access the broader Internet during match times,” Paine notes.

While Cloudflare remains vehemently against aggressive blocking demands, it is slowly but steadily increasing its cooperation with rightsholders. In addition to the earlier mentioned streaming takedown efforts, Cloudflare also started to voluntarily block pirate sites in the UK.

As previously unveiled here, Cloudflare started blocking domain names based on older site-blocking orders where it wasn’t a party. This is similar to the approach Google takes in various countries.

According to Paine, this blocking action in the UK is part of a voluntary agreement with rightsholders, affecting Cloudflare’s pass-through CDN and security services.

“When we take action on domains pursuant to these orders, we post an interstitial page that returns a 451 status code that directs the visitor to the specific order, which includes a process for affected parties to contest the blocking action.”

According to Paine, Cloudflare’s voluntary blocking gesture shows that the company is willing to take action as long as the requests are reasonable.

“Our efforts in the UK to block content based on a finding of infringement in an order directed to a third party reflect our desire to experiment with more targeted approaches than the overblocking we have seen in other countries in Europe,” Paine notes.

Combined with the increased automated reporting and API-driven takedowns, it seems likely that the copyright enforcement volume will continue to increase in the years to come.

At the same time, however, Cloudflare will continue to resist egregious piracy-blocking efforts that break the foundations of the Internet, including DNS-based blocking.

The Mass Shooter Ron Soye · Dec 30, 2025

TorrentFreak: Premier League Targets Dozens of Pirate Streaming Sites through Cloudflare Subpoena (archive) (mega)

December 30, 2025 09:06:35 UTC by Ernesto Van der Sar

England’s Premier League has obtained a DMCA subpoena against Cloudflare, hoping to curb the seemingly unbridled growth of sports streaming services. The filing in the Central District of California identifies dozens of infringing domains and demands that Cloudflare produce identifying data, including account history and physical addresses.

As England’s top football competition, the Premier League draws hundreds of millions of viewers from all over the world.

Aside from the sportive stakes, the Premier League also has a vested interest in selling broadcast rights. These rights generate billions of pounds in revenue per year; a staggering amount unmatched by any other football league.

Yet, other leagues are not the main threat to these broadcast revenues. Instead, piracy has emerged as the Premier League’s main nemesis, with many football fans turn to cheaper pirate streaming services to watch ‘the people’s game’.

In recent years, the Premier League has tried several legal avenues to tackle the piracy problem. In addition to obtaining blocking orders in multiple countries, the organization has been a driving force behind several lawsuits, some of which resulted in prison sentences.

Cloudflare & Pirate Sites

While the football league typically finds the law on its side, identifying its ‘opponents’ isn’t always easy. Operators of streaming sites and services are typically aware of the legal risks and do their best to remain anonymous. Presumably as part of this strategy, they use services made available by Cloudflare.

Cloudflare doesn’t make the operators of piracy sites ‘anonymous’ but it does shield their hosting locations from public view. Rightsholders can overcome this barrier through formal complaints, after which Cloudflare identifies the hosting services. To obtain additional information, however, rightsholders have to go to court.

Earlier this month the Premier League took this follow-up step by asking a California federal court to issue a DMCA subpoena. The request, filed in the U.S. District Court for the Central District of California, identifies dozens of target pirate streaming sites and “Access Points”. Through the court, the Premier League hopes to identify the persons connected to these domains.

Premier League Requests Action

Before going to court, the Premier League’s American law firm, Hagan Noll & Boyle, sent a formal notification to Cloudflare.

“Cloudflare is asked to remove or disable access to Premier League’s copyrighted works, which, based on the infringement that has occurred to date through the websites and domain names identified above, will continue to be infringed in this same manner throughout the Premier League season,” attorney Timothy M. Frank wrote.

Letter to Cloudflare

The letter identifies specific streaming site domains and includes screenshots of the websites where these are shown.

In addition to public-facing sites, the Premier League pointed to various “backend links” where the pirated football streams are actually being sourced. The legal paperwork shows unauthorized broadcasts of various matches including Brentford v. Leeds United, Crystal Palace v. Manchester City, and Nottingham Forest v. Tottenham Hotspur.

One of the streaming sites captured in evidence

Several of the targeted sites utilize sophisticated redirection chains to reach their audience. For example, dooball345.com was found to redirect through dooball345s.com before landing on dooball345x.com. Similarly, pelotalibrevivo.net redirects users to pirlotvenvivo.club.

The court records also highlight how these sites often use unique CDN links and m3u8 playlists, sometimes involving tokens and session IDs—to serve live content to millions of global viewers.

Cloudflare Must Identify Operators?

The Premier League’s letter to Cloudflare didn’t result in the immediate termination of the accounts, but it is used to request the DMCA subpoena at the the California federal court.

The proposed subpoena, which has yet to be signed off on, would require Cloudflare to hand over information sufficient to identify the alleged infringers, including any names, physical addresses, IP addresses, telephone numbers, email addresses, payment information, account updates, and account histories.

Whether the Premier League will find any of the information usable is another matter. Many pirate site owners use inaccurate data, but the explicit request for payment information and account history aims to provide a clearer financial trail than standard subscriber data.

The subpoena

A copy of the requested DMCA subpoena is available here (pdf) and the Premier League’s declaration can be found here (pdf). Below is a list of the targeted “Access Point” domain names identified in the legal filing:

– 247sport.org
– 4k-yalla-shoot.info (redirects to yallashootspro.com and 3arabsports.net)
– antenasport.org
– bingsport.site
– deporte-libre.click
– dooball345.com (redirects to dooball345s.com and dooball345x.com)
– goaldaddyth.com
– hesgoal.watch
– librefutboltv.su
– livesports088.com (redirects to keelalive52.com)
– ovogoaal.com
– pelotalibrevivo.net (redirects to pirlotvenvivo.club)
– rbtvplus17.help (redirects to fctv33.work and nplb6earneyhtycourage.sbs)
– ronaldo7.me (redirects to streameasthd.com)
– t4tv.click
– vachvoi.link
– wearechecking.online (redirects to wac.rip)
– yallalshoot.com
– yalla4shoot.com
– yallla-shoot.com (redirects to yallashoot-4k.com, yallashootlivehd.com, wuyh.online )
– sportshd.app

Strawb3rry · Jan 9, 2026

The Italian government is fining Cloudflare 17 million dollars for not censoring the Internet hard enough. Matthew Prince is not happy.

Posts:

https://x.com/eastdakota/status/2009654937303896492?ref_url=

https://x.com/eastdakota/status/2009668601335464317?ref_url=

Archive:

https://archive.ph/dvFTO

https://archive.ph/wip/pfUCH

ChickenFriedFan · Jan 9, 2026

Hope they get fined another 10 bajillion dollars and Matthew ends up having to suck Truck Driver dick for spare change.

Disaster Cloudflare News Megathread

Shit nobody cares about Expert ✅

High Stakes, Highest Courts​

Q1: Storing vs. Linking?​

Q2: Hosting or Caching?​

Going forward​

Shit nobody cares about Expert ✅

Cloudflare Held Liable For Anonymous Users​

Liability and Future Growth​

Cloudflare Ups the Stakes, Warns of Global Implications​

The Publishers’ View the Decision in a Different Light​

A Decision That Aligns With Cloudflare Policy​

Card games Addict that like Kamen Rider.

Shit nobody cares about Expert ✅

Shit nobody cares about Expert ✅

ThatFatassWithTheCigar.com

Pika Pika!

Shit nobody cares about Expert ✅

Shit nobody cares about Expert ✅

Fewer Options For UK Pirates​

Exploiting The Fallout from Blocking Measures​

Not a Cloudflare Notice, But a Serious Distraction​

don't do stance, kids

Flock and Cyble Inc. Weaponize "Cybercrime" Takedowns to Silence Critics​

The Evidence​

Throwing Mud at the Wall​

Update: Cloudflare Responds​

We Aren’t Going Anywhere​

"Please remove your handcuffs so I can arrest you"

I am LORD Frieza, yes. Honk honk.

Well-oiled and ready to last for the long-run

Shit nobody cares about Expert ✅

No Particular Enemies, Just Most Rightsholders, Generally​

DMCA Subpoena to Cloudflare​

ESA Wants to Track Down RuTracker’s Operator​

Attachments

Shit nobody cares about Expert ✅

3,800% Increase in Takedowns​

Rightsholders Get API Access​

Increased Blocking & DNS at Risk​

Clunky Blocks & UK Cooperation​

Shit nobody cares about Expert ✅

Cloudflare & Pirate Sites​

Premier League Requests Action​

Cloudflare Must Identify Operators?​

Attachments

High Stakes, Highest Courts

Q1: Storing vs. Linking?

Q2: Hosting or Caching?

Going forward

Cloudflare Held Liable For Anonymous Users

Liability and Future Growth

Cloudflare Ups the Stakes, Warns of Global Implications

The Publishers’ View the Decision in a Different Light

A Decision That Aligns With Cloudflare Policy

Fewer Options For UK Pirates

Exploiting The Fallout from Blocking Measures

Not a Cloudflare Notice, But a Serious Distraction

Flock and Cyble Inc. Weaponize "Cybercrime" Takedowns to Silence Critics

The Evidence

Throwing Mud at the Wall

Update: Cloudflare Responds

We Aren’t Going Anywhere

No Particular Enemies, Just Most Rightsholders, Generally

DMCA Subpoena to Cloudflare

ESA Wants to Track Down RuTracker’s Operator

3,800% Increase in Takedowns

Rightsholders Get API Access

Increased Blocking & DNS at Risk

Clunky Blocks & UK Cooperation

Cloudflare & Pirate Sites

Premier League Requests Action

Cloudflare Must Identify Operators?