Skip to content


Subversion checkout URL

You can clone with
Download ZIP
Detect DNSChanger and Notify Visitors
Tree: eb0ad0e4fe

Fetching latest commit…

Cannot retrieve the latest commit at this time

Failed to load latest commit information.

Detect DNSChanger and Notify Visitors


This JavaScript is a CloudFlare app that checks whether a visitor is infected with the DNSChanger malware, and notifies the visitor if so.

Using This Tool

The easiest way is to put your site on CloudFlare and go to to enable the app.

How It Works

DNSChanger Detector works by attaching an alerting function to the window, and making a JSONP call to a special URL. The IP resolved for that URL by the infected servers serves a file that calls the alerting function.

The alert is banner at the top of the page with information about how to fix the infected computer. It looks like

For Non-CloudFlare Sites

The JavaScript is packaged for use with cloudflare.js on CloudFlare, but it will work on non-CloudFlare sites if you add a script tag for cloudflare.js

<script type="text/javascript" src="//" async></script>


CloudFlare is trying to make the Internet better for everyone.

The Federal Bureau of Investigation (FBI) has been operating DNS servers to keep infected users online, but they are going to stop soon (July 9, 2012). We want to do what we can to keep people from being kicked off the Internet when that happens.

For more background, see

Something went wrong with that request. Please try again.