requests for particular CDNs

[claustromaniac]

Use this issue for requests regarding individual CDNs.

Platform to investigate	Added in	Notes
75CDN
Advanced Hosting
Akamai	98ec768
Alibaba Cloud	47c01bd
Amazon Cloudfront	98ec768
Amazon Shield	9e347b6
Azion	❌	Needs custom pragma in the request to get debug headers in the response
Azure	❌	Can't be detected reliably via headers.
Baidu	6cc3ae8
BelugaCDN	6cc3ae8
BootCDN
BootstrapCDN	6cc3ae8
BunnyCDN	6cc3ae8
CacheFly CDN		Offers custom CDNs and multi-CDN setups, seizing other popular CDNs (like Cloudflare)
CDN.net
CDN77	e3112f7
CDNetworks	a149a10	Uses Zenedge internally
cdnlion	❌
ChinaCache	9e347b6
Cloudflare	1fa92cc
Cloudflare AMP		Already detected by CF filters
Cloudflare IPFS gateway		Same as above
Edgecast	e3112f7
Fastly	33f24e4
fly.io	9e347b6
Flywheel	9e347b6
G-CDN	a149a10
GitHub	6cc3ae8
GoCache	e3112f7
Google AMP
Google Cloud	33f24e4
Google Project Shield	6e8c38d
Huawei Cloud	❌
Highwinds	a149a10
IBM Cloud	❌	CDN powered by Akamai.
ICSS	❌
Incapsula	6e8c38d
Instart Logic	6fe4d17
IPFS	6fe4d17	Not a CDN, but a gateway.
jsDelivr	❌	Uses StackPath, Cloudflare, Fastly, and Quantil.
KeyCDN	6e8c38d
Kinsta	98ec768	Hosting powered by Google Cloud, CDN powered by KeyCDN.
Leaseweb	6fe4d17
Limelight
Link11	❌
MaxCDN / StackPath
MyraCloud	98ec768
NetDNA	9e347b6
Netlify	6fe4d17
NetScout	❌
Netskope
OVH
QiHU	6cc3ae8
Qiniu
Quantil	e3112f7
section.io	a149a10
SingularCDN	6fe4d17
Sucuri	6e8c38d
staticfile		Open source CDN for open source libraries. Can detect by URL.
Tor2web	ad6de0c	Not a CDN, but a gateway.
TransparentCDN	1ad2d8d
Variti	6cc3ae8
Zenedge	6fe4d17

Notes

• Researching these cloud services can take quite a lot of time, and results are not guaranteed. Please be patient.
• I only add new items to the extension when I can detect them in a fairly reliable and efficient way.
• Items marked with ❌ are items that I already investigated considerably, but still haven't figured out how to detect reliably and efficiently. I may eventually get back to investigating these, but they lose priority.

Block Cloudflare MiTM Attack used to provide options to detect/inform about:

• Incapsula
• Google Project Shield
• Sucuri

Thus far haven't came any info that AWS or Azure deploying SSL MitM techniques

[claustromaniac]

I'm starting to think that I should make the extension detect as many CDNs as it can, for the following simple reasons:

1. No matter what their individual practices are or what they want us to believe, reverse proxies pose risks to the users, period. It's a model based on trust, therefore it is flawed by design.
2. Political neutrality. The extension should focus on providing information, and leave all decision-making to the users. Having a solid stance against Cloudlfare but not against the other CDNs could in some cases mean giving users a false sense of security, which would be counter-productive.

What I'm asking myself now is... how should I go about this? If I were to make this the official philosophy, should I rename this to, say, Detect CDN, and make sure it treats all CDNs the same way?

Can I be arsed to do that? Oh so many questions...

---

EDIT: Welp. It's done. Detect Cloudflare+ is a thing of the past.

https://www.link11.com/en/cdn/
https://www.link11.com/en/ddos-protection/ -> requires private key for the domain's TLS certificate

---

https://myracloud.com/en/cdn-content-delivery-network/
https://myracloud.com/en/ddos-protection/ > requires private key for the domain's TLS certificate

🐈 : Added in v1.1.0

---

https://www.telekom-icss.com/business-areas/internet-content/cdn-solution
https://www.telekom-icss.com/business-areas/internet-content/ddos-defense/backbone-security -> requires private key for the domain's TLS certificate

---

https://www.netscout.com/arbor-ddos -> requires private key for the domain's TLS certificate

[claustromaniac]

Well now, those will be a nice challenge. I don't see any immediately apparent way to detect them, except for the MyraCloud one. Also, I find it curious that NetScout uses Cloudflare to serve its own website.

It will likely take some time before I can properly research them.

[ajvsol]

Google AMP, CloudFlare AMP and all other AMP caches.

Also consider gateways like Cloudflare's IPFS gateway and Tor2Web's Tor gateway,

🐈 : Tor2web added in v1.2.0. IPFS added in v1.3.0

[claustromaniac]

This extension already detects requests to the CF IPFS gateway because those always go through their CDN (example). The same goes for CF AMP. I could provide some option to list those requests separately, but I wonder if it's worth it. I'll keep it in mind, though.

Tor2Web can be detected easily and reliably 👍

As for Google AMP... that one is a bitch. Those folks change their APIs every other week (figuratively speaking). I'll look into it though.

EDIT: Even if I decide not to give the CF IPFS gateway any special treatment, it may be worthwhile to detect connections to the IPFS outside of the CF realm. I think I can do that.

Not sure whether to classify as CDN

https://www.netskope.com/platform

Cloud and web traffic is steered to Netskope for inspection using our patented all-mode traffic steering technology
TLS-encrypted cloud traffic is safely decrypted using the Netskope cloud-scale architecture as part of the traffic steering process

1. https://www.alibabacloud.com/product/cdn
2. https://intl.huaweicloud.com/product/cdn.html
3. https://www.quantil.com
4. https://www.verizondigitalmedia.com/platform/edgecast-cdn
5. https://www.ovh.ie/cdn
6. https://www.jsdelivr.com
7. https://www.gocache.com.br/en
8. https://gcorelabs.com/cdn
9. https://www.cdn77.com
10. https://cdn.net
11. https://www.cachefly.com
12. https://bunnycdn.com
13. https://www.belugacdn.com
14. https://www.azion.com.br
15. https://special.advancedhosting.com/en
16. https://cloud.baidu.com/product/cdn.html
17. https://cdn.baomitu.com
18. https://www.staticfile.org/?ln=en
19. https://www.bootcdn.cn

16\. https://cloud.baidu.com/product/cdn.html

potential identifiers in the header:

• x-bce (-content | -request-id | -storage-class | -debug-id)
• ohc (-file-size | -response-time)
• server: JSP(3/2.0.14)

🐈 : I've seen the headers with ohc prefix in responses by China Telecom that didn't seem necessarily related to Baidu. They may not be reliable.

Azure may feature in the header

• X-MS (-ref (-originshield) | -meta(-data | -target | -abc) | -blob-content (-type | -disposition) | -client-request-id | -date | -version | -proxy | -lease-status)
• Server: Windows-Azure-(*)
• X-Midgress

Indicates whether the request was proxied through an additional CDN server. For example, a POP server-to-origin shield server or a POP server-to-ADN gateway server.
This header is added to the request only when midgress traffic takes place. In this case, the header is set to 1 to indicate that the request was proxied through an additional CDN server.

• X-EC-Debug

The debug cache request header provides additional information about the cache policy that is applied to the requested asset. These headers are specific to Azure CDN Premium from Verizon products.

• Via:

The format through which the Via request header identifies a POP server is specified by the following syntax:

Via: The terms used in the syntax are defined as follows:

Protocol: Indicates the version of the protocol (for example, HTTP/1.1) used to proxy the request.

Platform: Indicates the platform on which the content was requested. The following codes are valid for this field:
Code 	Platform
ECAcc 	HTTP Large
ECS 	HTTP Small
ECD 	Application delivery network (ADN)

POP: Indicates the POP that handled the request.

ID: For internal use only.

Example Via request header

Via: HTTP/1.1 ECD (dca/1A2B)

[claustromaniac]

Thanks. That's very helpful.

EDIT: actually, it's not.

Those are request headers, used by the CDN to talk to the origin server. I can't use those to detect Azure.

X-MS-* are the only exceptions in the ones you mentioned. Those are indeed response headers, but they are not reliable in the least. I have found several other azure-specific headers on my own, too, but I'm afraid none of them are reliable. Most of the times I visit a site served by this CDN I don't see any of them present.