Malte ZanderContents
- Why is a site behind Cloudflare harder to report?
- How do you tell that Cloudflare is in front?
- What does Cloudflare do with your report?
- How do you report a phishing site to Cloudflare?
- What do you report in parallel?
- What if the site stays online anyway?
- Does this apply to other CDNs and proxies?
- How does AI Fraud Protect help?
- FAQ
When a fake site sits behind Cloudflare, you only see the CDN's addresses, not the host's. Report the site through Cloudflare's abuse form. Cloudflare doesn't remove content it doesn't host, but it forwards your report to the website operator and the hosting provider and gives the host the origin IP. In parallel, report to the domain's registrar and to Google Safe Browsing, because those levers work independently of the CDN.
- Cloudflare forwards abuse reports to the website operator and the hosting provider and gives the host the origin IP of the content (Cloudflare).
- Cloudflare states that it cannot remove content from the internet that it does not host (Cloudflare).
- For some categories, reporters can ask Cloudflare not to forward the report to the website operator (Cloudflare).
- Registrars of generic domains must act promptly on actionable evidence of phishing, whichever CDN delivers the site (ICANN).
Why is a site behind Cloudflare harder to report?
Because the CDN sits between visitors and the actual server. When someone opens the page, a Cloudflare server answers. The domain's IP address therefore belongs to Cloudflare, not to the host, and a look at the network records leads you to the CDN instead of the host. Operators of fake sites like CDNs for exactly that reason: the service is quick to set up, often free and hides the server.
How do you tell that Cloudflare is in front?
From two places in the public data:
The IP address: Resolve the domain and check who owns the address. If the network records name Cloudflare as the holder, Cloudflare delivers the site.
The name servers: If the domain's name server record ends in ns.cloudflare.com, the domain also uses Cloudflare's DNS.
In both cases the host stays hidden. Sometimes older DNS records, subdomains or the TLS certificate reveal the origin, but don't rely on it. The route through Cloudflare is more reliable.
What does Cloudflare do with your report?
It forwards it rather than removing anything itself. According to Cloudflare, it sends the report to the website operator and the hosting provider and gives the host the origin IP so it can find the content (Cloudflare). Depending on the type of report, Cloudflare may also send you additional details that help with follow-up.
For your takedown, that means the host still makes the actual decision. Your report must therefore be complete enough for the host to act on without asking, because it reaches the host through Cloudflare.
How do you report a phishing site to Cloudflare?
Through the form at abuse.cloudflare.com. Here's how:
Secure the evidence. Desktop and mobile screenshots with date, time and the address bar, the full URL and the page source, before anyone is alerted.
Choose the right category. Pick the category for phishing or fraud, not the one for copyright, when the page asks for credentials or payments.
Enter the full URL. With path and parameters, exactly as victims received it.
Write the reason. One or two sentences: which brand is imitated, what the page asks for and where your real site is.
Check the forwarding to the operator. If the form offers the option not to forward the report to the website operator for your category, use it. In phishing cases, the operator is the criminal.
Submit and keep the confirmation. Record date, time and ticket number.
A text template for the description field is in Writing an abuse report that hosts actually act on.
What do you report in parallel?
Everything that doesn't depend on the CDN. The CDN doesn't change who manages the domain:
| Channel | Why it helps | What you need |
|---|---|---|
| Registrar | Can suspend the domain, after which the CDN no longer helps the operator | RDAP data, evidence, DNS abuse as the reason |
| Google Safe Browsing | A browser warning protects visitors right away | The full URL |
| Microsoft | A warning in the Microsoft Edge browser | The full URL |
| Host, once known | Removes the content and the account directly | Your report with a reference to Cloudflare |
If the domain was registered for the fraud, the registrar is usually your fastest lever. The reasoning is in Host, registrar or DNS.
What if the site stays online anyway?
Then the delay usually sits with the host, not the CDN. Follow up with Cloudflare using the ticket number and ask which host the report went to. Once you know the host, report to it directly and refer to the forwarded report. If it doesn't react, follow the escalation path in What to do when a host ignores your abuse report.
Does this apply to other CDNs and proxies?
In principle, yes. Other CDNs and reverse proxies usually don't host the content themselves either and have their own abuse forms or inboxes. Check in the network records who owns the IP and look for the abuse contact on the provider's website. Free website builders and cloud storage are different: there the platform hosts the content itself and can remove it directly.
How does AI Fraud Protect help?
AI Fraud Protect detects when a fake sits behind a CDN and prepares the report to the CDN together with the reports to the registrar, the DNS provider and Google Safe Browsing. The evidence package is the same for all channels, and the grounds fit each channel. A person reviews and sends every message, and the case stays on the follow-up list until the site is gone.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Will Cloudflare tell me who the real host is?
Cloudflare passes the origin IP to the host so it can act. Whether and which details you receive yourself depends on the type of report.
Can Cloudflare take the site down?
Cloudflare says it cannot remove content from the internet that it doesn't host. The host has to remove it. Independently of that, the registrar can suspend the domain.
Does the report alert the scammer?
Cloudflare generally forwards reports to the website operator as well. For some categories you can opt out. That's why you secure all evidence before reporting.
Do I need to report to Cloudflare if I already know the host?
It does no harm and helps if the host doesn't react. In any case, report to the host directly and to the registrar in parallel.