Disaster Cloudflare News Megathread

There's a lot going on with Cloudflare these days. I think it's time to put more of the discussion in one place. Bookmark This Thread.

Greatest Hits:

February 24, 2017: Major Cloudflare bug leaked sensitive data from customers’ websites
May 11, 2017: Cloudflare now allows anonymous complaints
August 18, 2017: Cloudflare drops Cody Wilson (Hatreon / GhostGunner) as client

July 17, 2019: Cloudflare Copyright Infringement Lawsuit Continues
August 5, 2019: Cloudflare: "Terminating Service for 8Chan"

April 15, 2020 (reposted May 5, 2024): The Devastating Decline of a Brilliant Young Coder - Lee Holloway programmed internet security firm Cloudflare into being
May 16, 2020: Shares In Cloudflare Soar, Making Co-Founder Matthew Prince A Brand New Billionaire

August 23, 2022: Pressure grows on Cloudflare to drop Kiwi Farms after latest doxing campaign
August 25, 2022: As Twitch Streamer Flees, Pressure Mounts On Cloudflare To Stop Protecting Controversial Kiwi Farms Site
August 30, 2022: Cloudflare tries to ignore the world
August 31, 2022: Cloudflare's abuse policies & approach
September 1, 2022: Cloudflare tries to explain why it protects far-right forums that stalk and harass victims
September 4, 2022: Under Pressure, Security Firm Cloudflare drops Kiwi Farms Website
September 4, 2022: I ran the worlds largest DDoS-for-Hire empire and CloudFlare helped
September 4, 2022: Cloudflare cuts ties with notorious trolling and harassment site Kiwi Farms
September 5, 2022: AP: Citing imminent danger Cloudflare drops hate site Kiwi Farms
September 6, 2022: Human life threatened: Cloudflare blocks troll forum Kiwi Farms
September 7, 2022: The Verge: How Cloudflare got Kiwi Farms wrong
September 9, 2022: Cloudflare explains why Kiwi Farms was its most dangerous customer ever
September 10, 2022: ReclaimTheNet: Cloudflare dropping Kiwi Farms reflects the growing erosion of neutral internet infrastructure
November 4, 2022: Cloudflare sinks 22% on 'insufficient' Q3 performance despite earnings beat

January 20, 2023: Cloudflare publishes report about how "internet blackouts" are being used by evil regimes to censor the internet and "control communication"
January 21, 2023: Cloudflare says White House asked tech firm to bypass Iran censorship, but US sanctions got in the way
January 21, 2023: Report Urges Cloudflare to Terminate Accounts of Pirate Sites
February 10, 2023: Cloudflare has admitted that one of its engineers "stepped beyond the bounds of its policies" and throttled traffic to a customer's website.
August 20, 2023: IP Address Blocking Banned After Anti-Piracy Court Order Hit Cloudflare
October 7, 2023: Cloudflare: Encrypted Client Hello (ECH) Effectively Defeats Pirate Site Blocking
November 3, 2023: Cloudflare is struggling with another outage - here's what to know
November 21, 2023: Cloudflare Blocks Abusive Content on its Ethereum Gateway
November 28, 2023: Court: Cloudflare is Liable for Pirate Site, But Not as a DNS Provider
December 31, 2023: DNS Block: Canal+ Sues Cloudflare, Google & Cisco to Fight Piracy

January 16, 2024: CloudFlare CEO Matthew Prince Responds To Employee’s Video Showing Her Getting Fired
February 2, 2024: Cloudflare Reports Thanksgiving 2023 Security Breach
February 13, 2024: Another “patent troll” defeated by Cloudflare and its army of bounty seekers
April 9, 2024: Meet Michael Price, the CEO of Cloudflare/champion of free speech and ONLY DEFENSE between websites and "people who want to take them down"- The Verge
May 10, 2024: Gaming Companies Want Cloudflare to Unmask Pirate Site Operator
May 28, 2024: Cloudflare took down our website after trying to force us to pay 120k$ within 24h
June 14, 2024: Google, Cloudflare & Cisco Will Poison DNS to Stop Piracy Block Circumvention (in France)
July 8, 2024: Cloudflare Blocks Pirate Sites After Web Sheriff Filed Laundry List of Violations
July 30, 2024: Nhentai ‘Pirate’ Site Wants Court to Quash ‘Improper’ Cloudflare DMCA Subpoena
August 1, 2024: Cloudflare once again comes under pressure for enabling abusive sites
August 7, 2024: [Malaysia] ISPs Hijack Cloudflare/Google DNS Requests, Ending Site-Blocking Workarounds
August 21, 2024: Cloudflare calls for regulatory harmonization amid rising internet challenges
November 7, 2024: Cloudflare to EU: Anti-Piracy Measures Shouldn’t Harm Privacy and Security
December 9, 2024: Cloudflare Blocks Pirate Site URLs “For Legal Reasons”

January 21, 2025: Cloudflare Issue Can Leak Chat App Users' Broad Location
March 17, 2025: Cloudflare: Password reuse is rampant, nearly half of observed user logins are compromised
March 22, 2025: Cloudflare turns AI against itself with endless maze of irrelevant facts
April 12, 2025: LaLiga/Cloudflare Crisis: ISPs Urged to Action Amid Mass Overblocking
May 11, 2025: DNS Piracy Blocking Orders: Google, Cloudflare, and OpenDNS Respond Differently
May 26, 2025: Cloudflare CEO: Football Piracy Blocks Will Claim Lives; “I Pray No One Dies”
July 22, 2025: Cloudflare Starts Blocking Pirate Sites For UK Users – That’s a Pretty Big Deal
September 22, 2025: Help build the future: announcing Cloudflare’s goal to hire 1,111 interns in 2026
October 18, 2025: Manga Pirate Site Operator Fails to Dodge DMCA Subpoena Over Cloudflare Cache
November 18, 2025: Cloudflare down: Websites such as X not working amid technical problems with the internet
 
It's almost as if a single entity being the global gateway to half the internet is a problem in a day and age where nothin functions without being online, huh?
 
I need big Null chungus to tell me what to think. I don't know which party to hate more.
 
Devil Advocate post: the company is too big to fail & backbone of the internet.
-We are at lawsuit arc to have them censor sites with lawsuit-

View attachment 8206766View attachment 8206824
The flaw with that cartoon isn't that Cloudflare is not embedded all over the place. They're correct - it is. The flaw is that if you removed it, you wouldn't see the whole stack collapse because Cloudflare is easy to replace.

(Easy in relative terms, that is. Obviously if you're Null working away at 3am to do everything single handed, less so. But there's nothing indispensable about Cloudflare).
 
Last edited:
If only someone, ideally a CEO of one of these incredibly powerful and influential companies with CIA connections, had had the foresight to see that censoring anything would open a Pandora's box of various governments demanding all manner of things be censored. Alas...

Anyone know if null responded to this on xitter? Or is mentioning that Mr. Prince is buddies with the CIA and censoring the web on their behalf so no one finds out Isabella Loretta Janke boils hamsters alive and tried to induce Chris Chan to fuck his mom to hot for xitter?

ETA:
(Easy in relative terms, that is. Obviously if you're Null working away at 3am to do everything single handed, less so. But there's nothing indispensable about Cloudflare).
I have to disagree pretty strongly here. Conceptually cloudflare is pretty simple but even the hardware required to filter the big DDOS attacks at one point is going to be 10's of millions if not hundreds of millions of dollars. And that's before you realize they have CDN caches basically all over the world that need to be robust and need to physically be spread out for latency reasons. The organizational structure itself in tons of jurisdictions, agreements with other companies, real estate, and networking hardware would be hard to replace.
 
Last edited:
Anyone know if null responded to this on xitter? Or is mentioning that Mr. Prince is buddies with the CIA and censoring the web on their behalf so no one finds out Isabella Loretta Janke boils hamsters alive and tried to induce Chris Chan to fuck his mom to hot for xitter?
Yeah, here:

https://x.com/KiwiFarmsDotNet/status/2009718999517429948 (archive) (nitter)
https://x.com/KiwiFarmsDotNet/status/2010103561888379294 (archive) (nitter)
funny-matthew.webpgay-little-bitch.webp

Bonus:
https://bsky.app/profile/acvalens.com/post/3mc3dnvdjfs2k (archive) (mega)
matthew-bonkers.webpcloudflare-doxxing.webp
 
Last edited:
lmao at him blocked jersh. I hope Matthew enjoys the finding out phase of his life that is beginning in earnest.
 

This is actually very worrying. They even demand DNS censorship and censorship world wide, not just in Italy or the EU.
I mean it's hard being sympathetic to CF after what they did with KF and working with censors but this is bad.
 
The guys of American Thinker ranted about Italy push for censorship on Cloudflare.

Cloudflare Under Pressure from Italian Authorities
The struggle over control of information, censorship, and economic dominance in the digital space is increasingly becoming a fundamental civilizational question.

Thomas Kolbe | January 17, 2026

Italian authorities are attempting to force the internet service provider Cloudflare to delete and block certain online services. Cloudflare is resisting and has turned to the U.S. government for support. The fight for a free internet is intensifying.

The struggle over control of information, censorship, and economic dominance in the digital space is increasingly becoming a fundamental civilizational question. That the European Union now sees not only the EU Commission but also national governments and security apparatuses siding with information diktats, against the fundamental principle of free speech, sends a dangerous signal to the world. The EU has effectively withdrawn from the circle of freedom-oriented state actors.

Into this picture fits a recent report from Italy. A tweet by the founder and CEO of the internet infrastructure provider Cloudflare, Matthew Prince, has caused a stir.
 
Cloudflare was targeted by a Spotify lawsuit against Anna's Archive:

TorrentFreak: Unsealed: Spotify Lawsuit Triggered Anna’s Archive Domain Name Suspensions (archive) (ghost) (mega) (wayback)
After reviewing the evidence, and without a defense, the court concluded that the music companies’ copyright infringement claim will hold up. Therefore, the court ordered that Anna’s Archive is enjoined from ‘hosting, linking to, [or] distributing’ the copyrighted works.

Since it’s uncertain whether Anna’s Archive will comply, the injunction also targets many third-party intermediaries, including domain registries and registrars, hosting companies, and other service providers.

These companies should assist in stopping the infringing activity on Anna’s Archive.

To avoid uncertainty, the court explicitly mentions that the targeted companies include the Public Interest Registry; Cloudflare Inc.; Switch Foundation; The Swedish Internet Foundation; National Internet Exchange of India; Njalla SRL; IQWeb FZ-LLC; Immaterialism Ltd.; Hosting Concepts B.V.; and Tucows Domains Inc.

The addition of Cloudflare stands out because the company operates a proxy service, without hosting Anna’s Archive’s content permanently. However, that was sufficient for the court to issue the order.
https://kiwifarms.st/threads/u-s-co...ore-trouble-for-the-site.237328/post-23512224
https://kiwifarms.st/threads/shadow-libraries.225939/post-23512192
 
No news article (yet) but felt like this should be crossposted.
A Cloudflare genius posted a vibe-written blog post (archive). By looking at the Github code linked in the article, one can find some truly amazing code that says and does completely different things. It is also littered with "TODO"s. Fear not, however, because the best way to fix these TODOs in your code? You guessed it, just delete them. And then git force push it. The commit is, of course, very comedic to look at.
Retard CEO responds:
 
TorrentFreak: Belgian Pirate Site Blocking Order Targets Cloudflare and Google, But Not Their DNS (archive) (mega)

February 23, 2026 11:55:04 UTC by Ernesto Van der Sar

Belgium's site-blocking machine keeps turning. A new order, obtained by local broadcasters RTL Belgium and RTBF, compels ISPs, Cloudflare, and Google to restrict access to five illegal IPTV services. Importantly, the latter two are not required to block content through their DNS resolvers, which is likely the result of an ongoing legal challenge. Notably, DNS providers are spared this time around, likely reflecting the ongoing legal fallout from earlier Belgian orders that drove Cisco's OpenDNS to temporarily abandon the country.

Belgium has become one of Europe’s most active testing grounds when it comes to pirate site-blocking enforcement.

The country’s two-step system, where a court issues an injunction and a government department (BAPO) then determines how it is implemented, has resulted in a series of diverse site-blocking orders since the framework launched in 2025.

An Eclectic Site Blocking Push​

The first order, obtained by sports broadcaster DAZN in April 2025, started quite aggressively. It required ISPs and third-party DNS resolvers, including Cloudflare, Google, and Cisco’s OpenDNS, to stop resolving over 100 pirate domains. If not, they would risk a fine of €100,000 per day.

Cisco refused to comply with the order and instead pulled OpenDNS out of Belgium entirely. Cloudflare and Google remained in Belgium and cooperated, though each did so in its own way.

A second blocking order followed in July last year, requiring various intermediaries, including ISPs, hosting companies, and payment services, to block shadow libraries. Initially, Internet Archive’s Open Library was also targeted, but this decision was eventually reversed after the U.S. non-profit agreed to geo-block certain content on its service.

Meanwhile, Cisco reportedly appealed the initial site-blocking order and returned to Belgium. While this appeal remains ongoing, the Belgian site-blocking machine didn’t stop.

Last November, an order obtained by Disney, Netflix, Sony, Apple, and others, targeted popular movie piracy sites, including 1337x and Soap2day. Notably, this order only applied to Belgium’s five major ISPs. DNS resolvers were nowhere on the list, likely due to Cisco’s appeal.

First IPTV Blocking Order​

A new order, issued by the Court of Brussels, targets five illegal IPTV services: LEMEILLEURIPTV, BESTIPTVABO, ATLASPRO12, OTT PREMIUM, and MIJNIPTV. The order was obtained by Belgian broadcasters RTL Belgium and RTBF, whose broadcasts were distributed by these services without permission.

IPTV targets

iptvblock.png.webp

The implementation decision, published by Belgium’s Department for Combating Infringements of Copyright and Related Rights Committed Online (BAPO), described the IPTV services as “structurally dedicated to the mass infringement of audiovisual content”.

Note: While the BAPO implementation order does not explicitly name the rightsholders, it lists specific content from RTL Belgium and RTBF. Both broadcasters confirmed obtaining an IPTV blocking order against Belgian ISPs at the Brussels court earlier this month.

According to information shared by the rightsholders, the services used cryptocurrency, which they see as a sign of illegality. In addition, the IPTV services showed users how to circumvent blocking measures.

All in all, the implementation order requires Belgium’s five major ISPs, Proximus, Telenet, Orange Belgium, Mobile Vikings, and DIGI Communications, to block domain names associated with these IPTV services. This also applies to mirror sites and redirect domains that can be added to the blocklist in future updates.

Cloudflare and Google Are Back, But Not for DNS​

The ISPs will have to use DNS-based blocking measures, as is standard procedure in most countries. However, DNS blocking measures are not requested from Cloudflare and Google, which are also covered by the injunction.

The order names the American tech companies as intermediaries and requires them to help stop the IPTV services through other routes.

Specifically, if Cloudflare acts as a CDN or hosting provider, it must take measures to prevent Belgian users from accessing the named IPTV services. Crucially, Cloudflare’s DNS resolver and WARP service are not covered.

Google is not required to block the domains on its DNS resolver either. Instead, Google must de-index the relevant domains from its search results, deactivate associated Google Ads, and block access through Google Sites and Google Cloud services where applicable.

This omission of any third-party DNS restrictions is almost certainly not accidental. Cisco’s appeal of the April 2025 order resulted in a Brussels court suspending enforcement of the DNS blocking requirement, allowing OpenDNS to resume operations in Belgium pending a final ruling.

With that legal challenge still unresolved, rightsholders appear to have opted for a more defensible scope, targeting Cloudflare and Google in their roles as infrastructure providers rather than as DNS operators.

Exploring the Blocking Limits​

The latest blocking order shows how Belgium’s blocking regime continues to calibrate itself in real time. Each new order is seemingly shaped by the legal and practical fallout from the last.
  • April 2025: Initial DAZN order aggressively targets ISPs and third-party DNS resolvers. Cisco pulls OpenDNS from Belgium.
  • July 2025: Second order requires various intermediaries to block shadow libraries.
  • Summer 2025: Cisco appeals; court suspends DNS blocking requirement, allowing OpenDNS to return.
  • Nov 2025: Broad order against movie piracy sites applies strictly to ISPs. DNS resolvers are omitted.
  • Current: Broadcasters RTL & RTBF obtain IPTV blocking order. Cloudflare and Google are targeted, but are not required to block DNS.
Whether the broader DNS blocking orders will return depends in part on how Cisco’s appeal resolves. A ruling against DNS blocking obligations could permanently reshape the scope of future Belgian orders, and there may be even broader repercussions.

Increasingly, European countries are granting ever more far-reaching pirate site blocking orders, covering a broad range of intermediaries, including DNS resolvers, but also VPN providers.

While these orders have been given the green light in France, Spain, and elsewhere, they are not uncontested. Given what’s at stake, the European Court of Justice will likely be asked to weigh in eventually to lay out the ground rules.



A copy of the latest blocking implementation order, published by the Department for Combating Infringements of Copyright and Related Rights Committed Online, is available here (pdf).
 

Attachments



Screenshot_20260317-090925_Firefox Nightly.jpg

Standing up for the open Internet: why we appealed Italy’s "Piracy Shield" fine​

2026-03-16

Patrick Nemeroff
Emily Terrell

At Cloudflare, our mission is to help build a better Internet. Usually, that means rolling out new services to our millions of users or defending the web against the world’s largest cyber attacks. But sometimes, building a better Internet requires us to stand up against laws or regulations that threaten its fundamental architecture.
Last week, Cloudflare continued its legal battle against "Piracy Shield,” a misguided Italian regulatory scheme designed to protect large rightsholder interests at the expense of the broader Internet. After Cloudflare resisted registering for Piracy Shield and challenged it in court, the Italian communications regulator, AGCOM, fined Cloudflare a staggering €14 million (~$17 million). We appealed that fine on March 8, and we continue to challenge the legality of Piracy Shield itself.
While the fine is significant, the principles at stake are even larger. This case isn't just about a single penalty; it’s about whether a handful of private entities can prioritize their own economic interests over those of Internet users by forcing global infrastructure providers to block large swaths of the Internet without oversight, transparency, or due process.

What is Piracy Shield?​


To understand why we are fighting this, it’s necessary to take a step back and understand Piracy Shield. Marketed by AGCOM as an innovative tool to fight copyright infringement, the system is better understood as a blunt tool for rightsholders to control what is available on the Internet without any traditional legal safeguards.
Piracy Shield is an unsupervised electronic portal through which an unidentified set of Italian media companies can submit websites and IP addresses that online service providers registered with Piracy Shield are then required to block within 30 minutes. Piracy Shield operates as a “black box” because there is:
  • No judicial oversight: Private companies, not judges or government officials, decide what gets blocked.
  • No transparency: The public, and even the service providers themselves, are often left in the dark about who requested a block or why.
  • No due process: There is no mechanism for a website owner to challenge a block before their site becomes unavailable on the Italian web.
  • No redress: Along with a complete lack of transparency or due process, Piracy Shield offers no effective way for impacted parties to seek redress from erroneous blocking.
It’s not entirely surprising that Piracy Shield so clearly prioritizes the economic interests of media companies over the rights of Italian Internet users. The system was “donated” to the Italian government by SP Tech, an arm of the law firm that represents several of Piracy Shield’s major direct beneficiaries, including Lega Nazionale Professionisti Serie A (Italy’s major soccer league).

The high cost of Piracy Shield​


Almost immediately after Piracy Shield was rolled out, there were significant problems. In addition to the unworkable 30-minute deadline and the lack of safeguards described above, the scheme requires service providers to engage in IP address blocking. This creates an unavoidable risk of overblocking innocent websites due to the fact that IP addresses are regularly and necessarily shared by thousands of websites. Not surprisingly, within a few months of its launch, Piracy Shield caused major outages for people and businesses who had done nothing wrong.
Notable failures include:
  • Government and educational blackouts: Tens of thousands of legitimate sites were rendered inaccessible from Italy, including Ukrainian government websites for schools and scientific research.
  • Small business & NGO disruption: A wide range of European small businesses and NGOs focused on social programs for women and children were inadvertently blocked.
  • Loss of essential services: The system blocked access to Google Drive for over 12 hours, preventing thousands of Italian students and professionals from accessing critical files.
  • Persistent collateral blocking: A September 2025 study by the University of Twente confirmed that the system routinely blocks legitimate websites for months at a time.
Even when faced with clear evidence that Piracy Shield has caused significant and repeated overblocking, AGCOM did not change course. Rather, it chose to expand Piracy Shield to apply to global DNS providers and VPNs, services which are closely associated with privacy and free expression. AGCOM also started taking increasingly aggressive steps to force global service providers, even ones with no legal or operational presence in Italy, to register with Piracy Shield.

Cloudflare’s principled challenge​


The European Commission, following our complaint, expressed similar concerns, issuing a letter on June 13, 2025, criticizing the lack of oversight inherent in the Piracy Shield framework. And on December 23, 2025, the Italian administrative court issued an encouraging ruling requiring AGCOM to share with Cloudflare all the records that purportedly support Piracy Shield blocking orders. While we have not yet received those records, we expect them to shed significant light on Piracy Shield’s operations.

An excessive fine and still no transparency​


Rather than awaiting the outcome of our legal challenges, and less than one week after being ordered to disclose Piracy Shield records to Cloudflare, AGCOM moved on December 29, 2025, to issue its fine. The fine’s timing was not the only eyebrow-raising thing about it. The math behind the penalty is as flawed as the system it is seeking to enforce.
Under Italian law, fines for non-compliance are capped at 2% of a company’s revenue within the relevant jurisdiction. Based on Cloudflare’s Italian earnings, that cap should have limited any fine to approximately €140,000. Instead, AGCOM calculated the fine based on our global revenue, resulting in a penalty nearly 100 times higher than the legal limit.
This disproportionate approach sends a chilling message to the global tech community: if you question a flawed regulatory system or defend the rights of your users and the global Internet, you risk facing punitive and excessive financial retaliation.
At the same time, AGCOM still has not shared with Cloudflare the Piracy Shield records that it was ordered to disclose. Instead, just four days before the deadline for disclosure, AGCOM informed us that it would make some of the records available for inspection at an AGCOM facility in Naples, subject to supervision by AGCOM officials. These limitations are not just unreasonably burdensome and contrary to the letter and spirit of the disclosure order; they raise real questions about why AGCOM is so intent on resisting transparency.

Next steps: the path forward​


We are not backing down. Cloudflare is appealing the €14 million fine, pushing for full access to AGCOM’s Piracy Shield records, and will continue to challenge the underlying legality of the Piracy Shield blocking orders in the Italian administrative courts.
We recognize that rightsholders have a legitimate interest in protecting their content. In fact, we work with rightsholders every day to address infringement in ways that are precise and effective. But those interests cannot override the basic requirements of legal due process or the technical integrity of the global Internet and our network.
We will continue to pursue this challenge in the Italian courts and through the European Commission. Global connectivity is too important to be governed by "black boxes" with 30-minute deadlines that result in widespread overblocking with no means of redress. Cloudflare remains committed to building a better Internet: one where the rules are transparent, the regulators are accountable, and the infrastructure that connects the world remains free, open, and secure.
Cloudflare's connectivity cloud protects entire corporate networks, helps customers build Internet-scale applications efficiently, accelerates any website or Internet application, wards off DDoS attacks, keeps hackers at bay, and can help you on your journey to Zero Trust.

Visit 1.1.1.1 from any device to get started with our free app that makes your Internet faster and safer.

To learn more about our mission to help build a better Internet, start here. If you're looking for a new career direction, check out our open positions.
 
Back
Top Bottom