# Interesting article: CNAME Cloaking

**URL:** <https://community.ipfire.org/t/interesting-article-cname-cloaking/436>\
**Category:** Security\
**Created:** [27 November 2019 22:45 UTC](https://community.ipfire.org/t/interesting-article-cname-cloaking/436 "2019-11-27T22:45:53Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![trish](https://community.ipfire.org/user_avatar/community.ipfire.org/trish/32/16001_2.png) [@trish](https://community.ipfire.org/u/trish)\
**Post date:** [22 March 2022 16:17 UTC](https://community.ipfire.org/t/interesting-article-cname-cloaking/436/4 "2022-03-22T16:17:06Z")

</div>

Thank you Peter,  
Oh yes almost every Wordpress website is using Cloudflare.

I see these fellows are thinking about a similar idea,

> [@URL Filter and self updating blacklists?](https://community.ipfire.org/t/url-filter-and-self-updating-blacklists/6601/39):
>
> Yes it can. Read the NXDOMAIN part of the information. Unbound can’t return an IP for these cases, it has to reject at the domain level, so you turn this on by setting the return to be something other than an IP address. Valid returns are listed on the page, but something like -r always\_nxdomain will do what you want. Word of caution, I found this to be too restrictive. Many of the blocklists that are maintained by individuals or small teams are not the most accurate, and once a domain add…

@mutley created a script that can do CNAME inspection:

> **[GitHub - sfeakes/ipfire-scripts: Scripts for ipfire](https://github.com/sfeakes/ipfire-scripts#unbound-nxdomain)**
>
> Scripts for ipfire

> [@pmueller](#):
>
> an up-to-date list of these tracking subdomains at hand.

I wonder if this would help. This list is being updated every morning at 5:00 UTC  
[https://hosts.oisd.nl/basic/](https://hosts.oisd.nl/basic/) with 60000 domains  
or even the full list  
[https://hosts.oisd.nl/](https://hosts.oisd.nl/) with 1.8 million domains

If anyone is interested, here are some partial screenshots regarding the list:

 ![basc](https://community.ipfire.org/uploads/default/original/2X/b/bbda04257897c33395d26bb8fd62d72c7a309275.jpeg)

 ![inc](https://community.ipfire.org/uploads/default/original/2X/3/3cdc2e4e26df7ab58956a3059fa672a1fb8ee831.jpeg)

---

_[View the full topic](https://community.ipfire.org/t/interesting-article-cname-cloaking/436)._