# Report a phishing site behind Cloudflare You looked up a lookalike of your domain and its addresses belong to Cloudflare. That usually doesn't mean Cloudflare hosts the site. Most sites on Cloudflare use it as a pass-through proxy: visitors connect to Cloudflare, and Cloudflare fetches the pages from a hosting provider it hides. Cloudflare can also be the domain's registrar, or host the content itself on products such as Pages and Workers. Which of those it is decides where your report has the most effect. If customers have already received fake emails, start with [Someone is pretending to be my company](/guides/someone-is-pretending-to-be-my-company). ## Step 1: work out Cloudflare's role ``` dig +short A examp1e.com ``` Compare the addresses with the ranges Cloudflare publishes at [cloudflare.com/ips](https://www.cloudflare.com/ips/). If they match, Cloudflare is in front of the website. Then look the domain up on [ICANN Lookup](https://lookup.icann.org): - **Registrar is Cloudflare, Inc.:** Cloudflare is also the registrar. Its registrar abuse contact is `registrar-abuse@cloudflare.com`. - **Registrar is someone else** (Namecheap, GoDaddy, others): report to that registrar as well. See the [Namecheap](/guides/report-phishing-domain-namecheap) and [GoDaddy](/guides/report-phishing-domain-godaddy) guides. Check the mail servers separately with `dig +short MX examp1e.com`. If the lookalike is sending fake invoices, its mail host is another place to report. ## Step 2: collect the evidence - **The full URL** of every phishing page, not only the domain. Abuse teams act on specific URLs. - **Screenshots** of each page, with the date and address bar visible. - **The phishing email** with full headers. In Outlook: File > Properties > Internet headers. In Gmail: More > Show original. - **Your real site** and a sentence on how the fake one imitates it: copied login page, logo, company name, bank details on invoices. ## Step 3: submit Cloudflare's abuse form Use the form at [abuse.cloudflare.com](https://abuse.cloudflare.com). Cloudflare says it generally can't process complaints sent by email, and emailed reports will likely get an automatic reply pointing to the form. 1. Choose **Phishing & Malware**. Cloudflare's guidance is to use the content categories when Cloudflare's IP addresses appear in the website's DNS records. 2. If Cloudflare is also the registrar, file a second report under the **Registrar** category (or email `registrar-abuse@cloudflare.com`). 3. Enter each phishing URL, then describe the impersonation and paste the email headers as text. ## What Cloudflare does with it For sites using its pass-through service, Cloudflare says it will: - **forward your complaint** to the website operator and to the hosting provider, so they can act on it; - **give the hosting provider the origin IP address**, so the host can find the content; - depending on the complaint, **reply to you with additional details** so you can follow up. Cloudflare also says it can't remove content from the internet that it doesn't host. A pass-through report gets your evidence to the real host, but the takedown itself depends on that host. It's different when Cloudflare holds the content or the domain: - **Hosted products** (Pages, Workers and others): Cloudflare says it may remove or block access to content that violates its terms for those products. - **Registrar:** Cloudflare says that, consistent with ICANN requirements, it takes action to mitigate technical abuse such as phishing by domains using its registrar services. If Cloudflare's reply names the hosting provider, send that host your report directly too. ## When to go to the registrar instead Report to Cloudflare, and also go to the registrar when: - the domain is registered elsewhere. Suspending the domain takes down both the website and the email, wherever they're hosted; - the lookalike is used mainly for **email**, with no website or only a parked page; - Cloudflare's report has gone to the host and nothing has changed. Since 5 April 2024, ICANN-accredited registrars must promptly take reasonable action once they have actionable evidence of DNS abuse, which includes phishing. If a registrar doesn't respond, file an "Abuse/DNS Abuse (Registrar)" complaint with ICANN Contractual Compliance. For generic top-level domains, the registry also must at least refer actionable abuse to the registrar or act directly. ## If it keeps coming back - Report the URLs to [Google Safe Browsing](https://safebrowsing.google.com/safebrowsing/report_phish/) and [Microsoft](https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site), so browsers warn visitors. - If you hold a trademark and the domain stays in use, a UDRP complaint can transfer it to you. See [How to report a lookalike domain](/guides/report-lookalike-domain-takedown). ## Check your domain The [free scan](/#scan) lists registered lookalikes of your domain, how new they are and which have mail servers. The [lookalike domain checker](/tools/lookalike-domain-checker) runs that check on its own, and the [WHOIS privacy check](/tools/whois-privacy-check) shows what a registration reveals. ## Sources - [Cloudflare Trust Hub: Reporting abuse](https://www.cloudflare.com/trust-hub/reporting-abuse/) - [Cloudflare Trust Hub: How Cloudflare approaches abuse](https://www.cloudflare.com/trust-hub/abuse-approach/) - [Cloudflare: abuse report form](https://abuse.cloudflare.com) - [Cloudflare: IP ranges](https://www.cloudflare.com/ips/) - [Cloudflare Docs: Report abuse](https://developers.cloudflare.com/fundamentals/reference/report-abuse/) - [Verisign RDAP: cloudflare.com (registrar abuse contact)](https://rdap.verisign.com/com/v1/domain/cloudflare.com) - [ICANN Lookup (RDAP)](https://lookup.icann.org) - [ICANN: Advisory on DNS abuse obligations in the RAA and Registry Agreement](https://www.icann.org/en/contracted-parties/advisories/documents/advisory-compliance-with-dns-abuse-obligations-in-the-registrar-accreditation-agreement-and-the-registry-agreement-05-02-2024-en) - [ICANN Contractual Compliance: submit a complaint](https://www.icann.org/compliance/complaint) - [ICANN: Uniform Domain-Name Dispute-Resolution Policy](https://www.icann.org/resources/pages/help/dndr/udrp-en) - [Gmail Help: Trace an email with its full headers](https://support.google.com/mail/answer/29436) --- Source: https://nameward.app/guides/report-phishing-domain-cloudflare (updated 2026-10-30)