Question Protecting Your Site from DMCA & Powerless Scenarios?

A corporate website protected by Cloudflare is virtually risk-free from shutdowns or exposures, provided that the server configuration is secure and proper. This protection is further reinforced when considering the jurisdiction of your hosting provider/company, as some regions offer stronger resistance against DMCA takedowns and similar legal challenges.

Throughout my experiences in responding to various security incidents, I've observed attackers exploiting Cloudflare's infrastructure (or similar services) for hosting malicious content or utilizing their tools for network breaches. Cloudflare has consistently been the sole provider reluctant to reveal details about the origins they're shielding.

In summary, it's about weighing your requirements, budget, and preferences. Each provider has its strengths, so do some research and choose the one that aligns best with your goals. The alternatives you're considering are all solid, especially if you have someone to set them up properly. Note: I personally do not think Cloudflare needs to be decommissioned if you are already using it, it's a great product and probably the most bang for your buck.

For distributed hosting with servers in different countries but maintaining one website and database, using a major cloud provider like AWS, Azure, or GCP is probably the most straightforward approach. You can enable geo-redundancy with a couple clicks and put your servers behind their load balancing services, it would not really make sense to also keep a live copy of this redundant infrastructure elsewhere. Keep in mind that these providers can be pricey, especially if you're spreading across multiple vendors. Also factor in managed DDoS protection, which will run you a minimum of $3,000 per month per cloud vendor. You basically pay to not get charged for being under attack.

If bandwidth pricing isn't an issue, I'd recommend using AWS with Cloudflare. You could also set up Lambdas to periodically export your database/server off-site. This proactive approach ensures data redundancy and facilitates seamless migration if you ever need to switch providers. Consider your Recovery Point Objective (RPO) and Recovery Time Objective (RTO) to determine acceptable data loss and downtime during potential migration. You would then, in theory, only need to adjust the Cloudflare configurations accordingly.

However, if bandwidth costs are a concern, consider opting for a dedicated hosting provider like Hetzner, OVH, Scaleway, or Leaseweb behind Cloudflare. Ensure geo-redundant availability for your files and database by replicating data among providers or datacenters of a single provider. While this approach is cost-effective, real-time replication may be hindered by connection speed between providers. Despite potential complexities in managing dependencies and connections, this strategy offers a viable solution for maintaining availability.

I can recommend the providers below:

https://www.digitalocean.com/https://www.scaleway.com/en/https://www.hetzner.com/https://www.vultr.com/https://ramnode.com/

The key is to choose a registrar that won't suspend your domain. If you properly shield your origin it does not matter where you host, since they won't know what hosting party to contact. You can even do it without opening up your public IP address. You just need a registrar that will not suspend your domain or choose a TLD that is not administered by USA/EU.

I came across this online while researching registrars:

https://docs.google.com/spreadsheets/d/1lfCCdWLMKU9cok9T9UWWUf2EoEdkXU0gon9NDqnRJDs/edit#gid=0

0xDEADBEEF said:

The key is to choose a registrar that won't suspend your domain. If you properly shield your origin it does not matter where you host, since they won't know what hosting party to contact. You can even do it without opening up your public IP address. You just need a registrar that will not suspend your domain or choose a TLD that is not administered by USA/EU.

I came across this online while researching registrars:

https://docs.google.com/spreadsheets/d/1lfCCdWLMKU9cok9T9UWWUf2EoEdkXU0gon9NDqnRJDs/edit#gid=0

Click to expand...

Thank you for the list.

So, it doesn't matter which hosting provider you are using.

You won't be suspended by the server provider, but you could be suspended by the domain registrar?

yngmind said:

Thank you for the list.

So, it doesn't matter which hosting provider you are using.

You won't be suspended by the server provider, but you could be suspended by the domain registrar?

Click to expand...

You could be suspended by the provider as well, but generally, they prioritize targeting domain names first. Some registrars have automated takedown processes to the extent that multiple reports from certain sources can trigger an automatic domain suspension.

However, if your registrar is known for being uncooperative and you take the necessary steps to obscure where your application is hosted, the likelihood of a takedown becomes minimal.

0xDEADBEEF said:

You could be suspended by the provider as well, but generally, they prioritize targeting domain names first. Some registrars have automated takedown processes to the extent that multiple reports from certain sources can trigger an automatic domain suspension.

However, if your registrar is known for being uncooperative and you take the necessary steps to obscure where your application is hosted, the likelihood of a takedown becomes minimal.

Click to expand...

That's cool.

What about CF? I know that they receive DMCA and immediately leak the host's real IP address.

Can cloudflare ban access to the website?

Cloudflare will just stop forwarding any traffic. But you could reach out to @Radko I think he has some houses left without okupas and you may become his next guest. He pays for your internet and electricity, while you can host with anonymity.

yngmind said:

That's cool.

What about CF? I know that they receive DMCA and immediately leak the host's real IP address.

Can cloudflare ban access to the website?

Click to expand...

As @daniels27 mentioned, they will not leak the origin IP. But they will probably blacklist it, and same goes for your domain name. So you would have to start over with a clean setup.

They used to be very flexible, but nowadays they will comply faster to legal requests. Depending on who files the request and the type of content hosted, it can still take weeks or months for them to stop forwarding your traffic.

But still with the right setup you can leverage CDNs to help you out. Just need to keep providers separate for registering domains, servers and proxying.

It depends on what content you run and which authorities you piss off .
There is already a court ruling in Italy that Cloudflare is obligated to disclose the origin IP and other identity information . (https://torrentfreak.com/court-orders-cloudflare-to-block-and-identify-pirate-site-customer-241019/)
Cloudflare also forces users to upgrade to their Enterprise tier, especially if the content they host negatively impacts Cloudflare's IP reputation, such as gambling-related material.
In some cases, they may even require users to provide their own IP addresses to continue using their services.

0xDEADBEEF said:

As @daniels27 mentioned, they will not leak the origin IP. But they will probably blacklist it, and same goes for your domain name. So you would have to start over with a clean setup.

They used to be very flexible, but nowadays they will comply faster to legal requests. Depending on who files the request and the type of content hosted, it can still take weeks or months for them to stop forwarding your traffic.

But still with the right setup you can leverage CDNs to help you out. Just need to keep providers separate for registering domains, servers and proxying.

Click to expand...

Will they at least give you a deadline? Like you have a week to change Cloudflare DNS, otherwise we will shut you down?

yngmind said:

Will they at least give you a deadline? Like you have a week to change Cloudflare DNS, otherwise we will shut you down?

Click to expand...

I haven't dealt with this scenario as their customer. Usually the provider will limit or suspend you, then inform you about this. This is also heavily dependent on what you are hosting and the customer tier you are in. Big accounts get the benefit of the doubt.

yngmind said:

Will they at least give you a deadline? Like you have a week to change Cloudflare DNS, otherwise we will shut you down?

Click to expand...

It depends how friendly the Representative is and what type of business you are running .
From 2 cases I know personally it was around 1 week to move their entire Infrastructure .
There is also a public case where it was within 24 hrs . ( https://robindev.substack.com/p/cloudflare-took-down-our-website )