Short answer
Send the full phishing URL, screenshots of the live page and your official site to Cloudflare through its abuse email [email protected].
Who this is for: Teams that found a phishing copy of their site on a Cloudflare domain.
Where to report a domain to Cloudflare
| Abuse page | abuse.cloudflare.com/ |
|---|---|
| Phishing report form | abuse.cloudflare.com/phishing |
| Abuse email | [email protected] (its abuse contact in registration data) |
| IANA ID | 1910 |
| Also covers | Cloudflare Registrar, and sites behind Cloudflare's proxy |
Not sure the domain is with Cloudflare? Check it in our abuse contact lookup: it reads the registrar from RDAP.
What Cloudflare asks for
- The specific link to the phishing page. All evidence URLs in one report must have the same hostname.
- Logs or other evidence.
- The targeted brand, the country you saw it from and your user agent (optional).
Take full-page screenshots that show the address bar before you report: the page may be gone or hidden from you later. Our takedown request template covers all of the above.
What to expect
Cloudflare's abuse page states no processing time.
Most phishing sites use Cloudflare only as a proxy. Cloudflare says it cannot remove content and forwards complaints to the hosting provider and the site owner; once it confirms a phishing page, it shows visitors a warning page.
For domains registered with Cloudflare Registrar, Cloudflare acts on phishing itself. The form has a separate Registrar category.
Cloudflare notes that what you write may be released to third parties such as the Lumen Database, so leave out private details.
Accredited registrars of generic domains must act on actionable evidence of phishing under their ICANN contract. If nothing happens, see how to escalate to ICANN.
Report it here too
- The host. The registrar controls the domain, the host controls the site. The lookup shows when the site sits behind Cloudflare.
- Browsers. Google Safe Browsing and Netcraft make browsers warn visitors, often before the domain is suspended.
- Wallets. See how to report a phishing site to wallets.
Sources
- Cloudflare: abuse page
- Cloudflare: report form
- ICANN advisory: compliance with DNS abuse obligations
Frequently asked questions
How do I know a domain is registered with Cloudflare?
Look the domain up in RDAP: our free abuse contact lookup or ICANN Lookup shows the registrar, its IANA ID and its abuse contact.
What if Cloudflare does not act on my report?
Reply with new evidence, then file a DNS abuse complaint with ICANN Contractual Compliance and attach your report. Meanwhile report the site to Google Safe Browsing and Netcraft so browsers warn visitors.