Report a phishing site behind Cloudflare

You looked up a lookalike of your domain and its addresses belong to Cloudflare. That usually doesn't mean Cloudflare hosts the site. Most sites on Cloudflare use it as a pass-through proxy: visitors connect to Cloudflare, and Cloudflare fetches the pages from a hosting provider it hides. Cloudflare can also be the domain's registrar, or host the content itself on products such as Pages and Workers.

Which of those it is decides where your report has the most effect.

If customers have already received fake emails, start with Someone is pretending to be my company.

Step 1: work out Cloudflare's role

dig +short A examp1e.com

Compare the addresses with the ranges Cloudflare publishes at cloudflare.com/ips. If they match, Cloudflare is in front of the website.

Then look the domain up on ICANN Lookup:

Registrar is Cloudflare, Inc.: Cloudflare is also the registrar. Its registrar abuse contact is [email protected].
Registrar is someone else (Namecheap, GoDaddy, others): report to that registrar as well. See the Namecheap and GoDaddy guides.

Check the mail servers separately with dig +short MX examp1e.com. If the lookalike is sending fake invoices, its mail host is another place to report.

Step 2: collect the evidence

The full URL of every phishing page, not only the domain. Abuse teams act on specific URLs.
Screenshots of each page, with the date and address bar visible.
The phishing email with full headers. In Outlook: File > Properties > Internet headers. In Gmail: More > Show original.
Your real site and a sentence on how the fake one imitates it: copied login page, logo, company name, bank details on invoices.

Step 3: submit Cloudflare's abuse form

Use the form at abuse.cloudflare.com. Cloudflare says it generally can't process complaints sent by email, and emailed reports will likely get an automatic reply pointing to the form.

Choose Phishing & Malware. Cloudflare's guidance is to use the content categories when Cloudflare's IP addresses appear in the website's DNS records.
If Cloudflare is also the registrar, file a second report under the Registrar category (or email [email protected]).
Enter each phishing URL, then describe the impersonation and paste the email headers as text.

What Cloudflare does with it

For sites using its pass-through service, Cloudflare says it will:

forward your complaint to the website operator and to the hosting provider, so they can act on it;
give the hosting provider the origin IP address, so the host can find the content;
depending on the complaint, reply to you with additional details so you can follow up.

Cloudflare also says it can't remove content from the internet that it doesn't host. A pass-through report gets your evidence to the real host, but the takedown itself depends on that host.

It's different when Cloudflare holds the content or the domain:

Hosted products (Pages, Workers and others): Cloudflare says it may remove or block access to content that violates its terms for those products.
Registrar: Cloudflare says that, consistent with ICANN requirements, it takes action to mitigate technical abuse such as phishing by domains using its registrar services.

If Cloudflare's reply names the hosting provider, send that host your report directly too.

When to go to the registrar instead

Report to Cloudflare, and also go to the registrar when:

the domain is registered elsewhere. Suspending the domain takes down both the website and the email, wherever they're hosted;
the lookalike is used mainly for email, with no website or only a parked page;
Cloudflare's report has gone to the host and nothing has changed.

Since 5 April 2024, ICANN-accredited registrars must promptly take reasonable action once they have actionable evidence of DNS abuse, which includes phishing. If a registrar doesn't respond, file an "Abuse/DNS Abuse (Registrar)" complaint with ICANN Contractual Compliance. For generic top-level domains, the registry also must at least refer actionable abuse to the registrar or act directly.

If it keeps coming back

Report the URLs to Google Safe Browsing and Microsoft, so browsers warn visitors.
If you hold a trademark and the domain stays in use, a UDRP complaint can transfer it to you. See How to report a lookalike domain.

Check your domain

The free scan lists registered lookalikes of your domain, how new they are and which have mail servers. The lookalike domain checker runs that check on its own, and the WHOIS privacy check shows what a registration reveals.