New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
Usually cloudflare does not hand over the backend IP address to the complainant.
That is different for gov entities, and some selected trusted parties, but you can't just send them a random PDF and get an IP address back.
What cloudflare is doing is forwarding the request to the provider that operates the backend server, and is telling the complainant which provider it is.
Your experience sounds pretty conclusive, but it is completely at odds with mine. Everyone who files a complaint against me, whether an individual or a company, gets my IP address from Cloudflare right away, even if they never ask for it. Cloudflare simply inserts the IP into a template explaining that its service acts as a proxy and identifying the actual hosting IP. This is standard practice for them, possibly even an automated email template. Believe you or not.
These requests don’t come from courts. They can come from anyone, and Cloudflare’s response is always the same. Cloudflare will disclose my IP even to a private individual who dislikes a website exposing a scam he ran.
Bunny is even more ridiculous than CF. They act on plain-text complaints from private individuals and disclose the actual hosting IP addresses just the same.
Feel free to ask cloudflare about the IP address for the origin server of lowendtalk
They do forward the abuse report to your hosting provider, and are also telling your hosting provider about which IP address the abuse report is.
They will NOT share the origin IP with the person sending random abuse reports.
There is no automated email template that includes the origin IP address of the website, that would go to the person doing the report.
You’re funny. Then how do you explain all the copies of those emails I receive from them, along with the original emails from hosting providers? Why don’t you believe me? Because you haven’t seen it yourself? IP addresses aren’t personal data and aren’t protected by anyone. Cloudflare hands them out to everyone. Period. Don’t believe me? That’s your choice. I’m talking about something I deal with constantly, and 2026 has been a nightmare, with actual hosting IP addresses being handed out to ABSOLUTELY ANYONE who files a complaint.
Thanks for sharing your thoughts with us. Your advice was really helpful. I was planning to put my website behind Cloudflare, so thanks for reminding me about this.
Shinjiru is actually a really good provider, but the problem is that their Budget Linux plans come with no DDoS protection, which is why I’ve ruled them out as a hosting option for my website.
We get thousands of reports daily from CF (Mostly automated) and the reporters don't know the exact IP, we get separate email from CF which tells us the IP but the reporter doesn't get same information as us, you get "who is the provider" and we get the abuse report with the IP.
Cloudflare does not forward IP addresses. All that they forward is the hosting company so you can resolve the matter directly but they won't share the exact IP address to you. @Alyx is right.
Reason why CF doesn't share IPs with reporters:
"The majority (83% over the last week) of the abuse reports that we get involve allegedly copyrighted material transiting our network. Our early abuse policy specified that if we received an abuse report alleging copyrighted material we'd turn over the IP address of the hosting provider so the person filing the abuse report could report the abuse directly.
It didn't take long for malicious attackers to realize this provided an effective way to bypass our protections. They would submit a fake report alleging some image on a legitimate site had been illegally copied, we'd turn over the IP address of our customer, and they'd attack it directly. Clearly that wasn't a workable model.
As a result, we revised our policy to instead act as a proxy for abuse reports that were submitted to us. If a report was submitted then we'd proxy the report through and forward it to the site owner as well as the site's host. We provided the contact information so the parties could address the issue between themselves.
Idk.. if you get all the copies, it’s probably because they are sent to you/your provider, and not to the person doing the report.
But whatever. Religion is free; you can believe in whatever you want.
No need to trust the person working for various hosting providers for decades now.
Also no need to listen what others report on the internet 🤷
Agreed to those above: CF do not expose ip. they forward the complaints. Mostly those complaints are not important to the providers that say "DMCA ignored", so, you are good.
CF will protect you from DDoS too. close all ports, allow only from CF's IPs. Turn on CF firewall on rate limiting. That is. you dont need DDoS protection from the site. DDoS protection is overrated for websites.
I run 200TB/month, and never faced DDoS. Only a few times getting flood, and no issues.
I have said "Skrime is still usable". Because I am using one, mostly because no complains. ("you can still use, but not suggested") means failing over: Do fail over, they can terminate you, and you switch right away. I got complains on the first year mostly, then they gave up, but your users could be different. That's why I said Skrime is still ok.
Your case is light. And therefore, too many to pick. You do not need to go for those extremes like pirate bay. In fact, sometime they got raid, they got DDos, and you will get evolved.
Of course Cloudflare discloses IP addresses. Here's a routine email from March 2026. And it wasn't one.
Of course, you don't have to take my word for it, however, everyone who filed a complaint against me had all the hosting server details within a few hours to a day. I didn't always see how the process unfolded, so perhaps Cloudflare didn't disclose this information to everyone. But as you can see above, they did so on at least two occasions.
The first time, it was a plain-text email explaining how to query the server directly and obtain proof. The second time, they simply disclosed the information to the lawyers representing the rights holder.
How exactly does this work on your end? Do you automatically disclose the email address associated with the account, or do you first confirm what contact information can be shared? This is important because our project involves more than one person, and I don't want Company A to expose Person B's contact details to third parties without their knowledge or consent.
In my experience they only tell you who the provider is, not what the IP address is. I'll try and find an email from Cloudflare.
See above. What is this?
Maybe I'm just unlucky. Maybe the paper attacks against you were laughably insignificant. But here's the thing! CF and Bunny did EVERYTHING that one private individual asked them to do. All he did was write emails using AI (take notes, folks).
Then came two law firms that knew how to put together PDF files. They got everything they wanted, and then some.
You probably won't believe this, but it wasn't just real host IP addresses. There was also a PayPal account that got permanently banned, with absolutely no chance of ever getting it reinstated. Now you can't even discuss what happened. The moment they see the account ID, they forcibly shut down the chat. Most likely, there's some internal note on the account saying something like "Closed by order of the Security Department" or whatever. But I've never in my life seen a company shut down a support chat without even giving you a chance to talk.
The lawyers demanded reports detailing the actions taken by PayPal and Up-Networks. And guess what? Both companies complied, handed everything over on a silver platter, and dutifully submitted their reports.
Nobody gives a flying fuck about the rule of law, courts, or legally binding documents anymore. The moment these companies see a request from a lawyer, they lube up their assholes with Vaseline, get down on all fours, stick their asses in the air, and then suck the lawyers' dicks for good measure.
Why? I have absolutely no fucking idea.
You won't believe it, but the complainants even set their own deadlines, and the providers actually comply with them!
That is me quoting from Cloudflare source blog post that they don’t hand over IP information. It’s on their blog section.
Sorry, missed that comment. I guess they've changed it.
Pay enough money and there's quite a few providers who will stick up for you. I wouldn't risk a legal fight over $x-xxx/mo either.
It's not about money at all. I'm simply going through providers one by one, reading LowEndTalk. One provider gets glowing reviews, but I couldn't even log into their control panel, and support doesn't respond. Others turned out to be anything but anti-DMCA. Some are willing to bend over backward for anyone who files a complaint.
I already spend a decent amount of money on servers, and I always use more than three or four providers at a time, not just one or two.
I'm just going around on this carousel and sharing my experiences. There's no tragedy here.
Those are just lofty statements. There's what they say, and then there's reality. Maybe they don't do it every time, or maybe they didn't do it before a certain date. I am not an expert here.
If you found Moldavian providers interesting in particular, I haven't used iphost.md but it appears to be DMCA-ignored. Sadly almost nobody heard of it here.
There are no providers who will go to jail to protect your 3D model piracy site. There are providers with a quick trigger finger on bans and providers that ban slowly, but there are no providers who don't ban illegal content they can verify.
Eh, if you are fine with a bit of jank and suboptimal speeds just: https://nullchinchilla.substack.com/p/undoxxable-home-server
(I believe Anna's did the same in the past)
Nobody is risking an uplink for crumbs.