Backblaze B2
Backblaze B2 has a binary "bucket type" (`allPublic` or `allPrivate`) set at creation. Public buckets are listable and downloadable by anyone with the bucket name on `s3.<region>.backblazeb2.com` (S3 API) or `f<NNN>.backblazeb2.com` (native API).
Backblaze B2 exposure data
The trend chart appears once at least 7 days of history accrue.
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
B2's pricing favors public buckets for free egress through Cloudflare's Bandwidth Alliance. Operators chasing zero-cost CDN often flip `allPublic` permanently without realizing they've also enabled enumeration.
Real-world impact
The `b2_list_file_names` endpoint returns every object name in the bucket. Combined with public download, this is full enumeration + exfil.
Remediation
- Switch the bucket type to `allPrivate` and issue download authorizations per object.
- If public CDN distribution is the goal, use B2 + Cloudflare with a bucket-name allowlist worker, not an open bucket.
URL patterns
Backblaze B2 buckets typically resolve under hostnames like:
f005.backblazeb2.com/file/example/example.s3.us-east-005.backblazeb2.com
Check a specific Backblaze B2 URL
Paste any Backblaze B2 URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed Backblaze B2 bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request