Hacker News Reader

I'm replying to my own comment as I've had some new thoughts on how these attackers could have pulled it off.

1. Attacker registers hundreds/thousands of free CF accounts.

2. Each account gets assigned random CG nameservers (some dupes obviously)

3. Attacker than loads the assigned nameservers into a tool that looks for domains using those nameservers.

4. Attacker monitors those domains for accidental expirations.

5. Once expired, attacker adds domain in the CF account that matches the existing nameservers.

6. Once renewed domain comes back online, attacker controls DNS at Cloudflare.

> CF says they now no longer allow previously used nameservers to be used again. The only problem with this is if someone swaps CF accounts hundreds/thousands of times and "runs out" of custom names.

It’s not necessary for Cloudflare to remember or to reject all previously assigned name servers: Cloudflare can simply fetch the domain’s cached NS records before DNS enrollment and refuse to assign them again.

> Once the domain expires

If the domain is expired, someone else can buy it. This is normal. I don't understand where the attack is.