Hello, Cloudflare received an Child exploitation report regarding: uploader[.]luadk[.]lol. Please address this issue with your customer. If you have questions for Cloudflare about this report, please respond to abusereply@cloudflare.com, including the report ID in your response. Below is the report we received: Report ID: e0a2088ac37fa8b3 Logs or other evidence of abuse: URGENT: Repeat Offender / Ban Evasion - Mass Uploader Infrastructure for Explicit Roblox "Condo" Assets Behind Cloudflare Domain: uploader.luadk.lol Summary: This endpoint operates as an automated asset and game file uploader infrastructure specifically designed to mass-upload explicit/pornographic "condo" games directly to Roblox servers using compromised or throwaway accounts. The operator's upstream host was previously suspended following abuse complaints, but they have migrated to a new VPS and re-established their backend behind Cloudflare proxying to evade permanent enforcement. Key Violations & Technical Context: 1. Malicious Automation Tooling: The subdomain serves as a backend/API endpoint for an automated Roblox asset and game-upload botnet ("uploader") that bypasses safety filters to publish illicit sexual content onto a platform targeting minors. 2. Ban Evasion & Infrastructure Cycling: After their prior host suspended their services, the perpetrator simply spun up a new virtual machine and routed it through this domain via Cloudflare DNS/proxying to resume the illicit pipeline. 3. Upstream Hosting Compromise: The underlying VPS stores reverse-engineering scripts, stolen Roblox session cookies/.ROBLOSECURITY tokens, and unauthorized automated deployment tools. Please revoke Cloudflare proxy services for uploader.luadk.lol and forward this notification directly to the upstream VPS/hosting provider so that this newly provisioned instance can be terminated immediately. Reported URLs: hxxps://uploader[.]luadk[.]lol/unlock The actual host for uploader[.]luadk[.]lol are the following IP addresses. 80.76.43.228. Using the following command, you can confirm the site in question is hosted at that IP address: curl -v -H "Host: uploader[.]luadk[.]lol" 80.76.43.228 Cloudflare offers network service solutions including pass-through security services, a content distribution network (CDN) and registrar services. Due to the pass-through nature of our services, our IP addresses appear in WHOIS and DNS records for websites using Cloudflare. Cloudflare Trust & Safety
