How to Take Down a Phishing Site Hidden Behind Cloudflare

Why phishing sites use Cloudflare, what its abuse process can and cannot do, and how to run parallel reports to the host, registrar and browser blocklists.

You look up the IP address of a phishing site impersonating your brand and the answer is always the same: Cloudflare. The WHOIS record of the IP points to Cloudflare, the hosting provider is invisible, and it can feel like a dead end. It is not. Understanding what Cloudflare actually does for the site is the key to getting it removed.

Why so many phishing sites sit behind Cloudflare

Cloudflare is a reverse proxy and content delivery network used by a very large number of legitimate websites. When a domain is set up on it, visitors connect to Cloudflare’s servers, which then fetch content from the real server, known as the origin. The origin’s IP address is hidden from the public.

For criminals that is attractive for three reasons: it hides where the site is really hosted, it provides a free certificate and good performance, and it puts an extra step between a victim brand and the host. In most cases, however, Cloudflare is not the hosting provider. The phishing files sit on a server somewhere else.

What Cloudflare’s abuse process does

Cloudflare runs a public abuse reporting form with a dedicated category for phishing. Based on its published approach, a report generally leads to some combination of the following:

• Forwarding the complaint to the origin hosting provider and, in many cases, to the site operator.
• Sharing the origin host’s identity with the reporter, so you can contact that provider directly.
• Showing a phishing warning page in front of the site when Cloudflare itself confirms the abuse.

There is an important exception. If the site is hosted on Cloudflare, for example on its Pages or Workers platforms, Cloudflare is the host and can remove the content itself. Check the hostname and the response details to tell the two cases apart.

Writing a report that gets acted on

Reviewers handle large volumes of complaints, so make yours easy to verify:

1. List every malicious URL, not just the homepage. Kits often keep the root page blank and serve the fake login on a deeper path.
2. Explain the impersonation in one or two sentences: which brand, which legitimate page is being copied, what data is requested.
3. Attach evidence: timestamped screenshots and, ideally, a side-by-side comparison with your real page.
4. Describe any cloaking. Many phishing pages show content only to mobile browsers, to visitors from one country or to links containing a specific token. Tell the reviewer how to reproduce what you saw, or the site may look harmless to them.
5. Show your authority. State that you represent the brand. A third party should be ready to provide a letter of authorization.

Do not wait: run parallel tracks

A Cloudflare report is one track, not the whole plan. At the same time:

• Report the domain to its registrar. Suspending the domain takes the site offline no matter which CDN or host is behind it. The registrar is listed in the domain’s WHOIS or RDAP record.
• Submit the URLs to browser blocklists such as Google Safe Browsing, Microsoft SmartScreen, Netcraft, APWG and PhishTank, plus USOM in Türkiye. Warnings can appear well before the site is removed.
• Contact the origin host as soon as you learn who it is, with the same evidence package.

Finding the origin without crossing lines

Sometimes the origin can be identified through passive, public information: historical DNS records from before the domain moved to Cloudflare, certificate transparency logs, mail server records, or other domains in the same campaign that are not proxied. Stick to passive research. Probing or attacking a server you do not control is not a legitimate part of takedown work, even when the server is malicious.

Common mistakes that slow things down

• Reporting only the root domain while the phishing lives on a sub-path.
• Sending vague reports such as “this site is a scam” without evidence.
• Treating the first automated reply as the end of the process instead of following up.
• Forgetting that the same kit is probably running on other domains, some of them also behind Cloudflare.

For the full sequence from detection to re-emergence monitoring, read what happens after a phishing site is reported.

Let a specialist handle it

Phishvoid handles Cloudflare reports, registrar and host notifications, and blocklist submissions in parallel, under your signed letter of authorization and with unlimited takedowns in one subscription. Found a site already? Report a phishing site. Want to know what else is out there? Book a free exposure scan.