To report phishing involving Cloudflare, use its official abuse reporting service and provide the full malicious URL with evidence of the deception. First separate three possible roles: Cloudflare may provide a reverse proxy, host the content, or act as the domain's registrar. Those roles support different responses.
A Cloudflare IP address does not, by itself, establish that Cloudflare hosts the phishing page. That distinction explains why a report may be forwarded to another provider rather than result in content removal by Cloudflare.
This guide is for security and brand-protection teams reporting a suspected impersonation site. It covers the service-role decision and reporting handoff, not legal domain recovery.
How Outtake handles phishing reports autonomously
Outtake Brand Protection connects phishing investigation with autonomous remediation. Your team manages the case in Outtake rather than rebuilding the evidence packet and manually filing reports at each supported provider.
For a phishing case involving Cloudflare, the service-role distinction still matters. Outtake's platform workflow brings investigation, evidence packaging, automated reporting, escalation and verification together:
- Investigate the infrastructure. Connect the phishing URL with related assets and hosting or registration evidence before selecting the response path.
- Prepare the provider evidence. Package the affected URL, impersonated identity and observed deception for review.
- Report and escalate. Submit supported provider reports through Remediation Agents and route the case for escalation, instead of leaving your team to manage separate reporting queues.
- Verify what changed. Track the reported asset through takedown verification and investigate connected assets that still require action.
Automation does not change what Cloudflare can control. A proxy-related complaint may still require action by the origin host, while hosting and registrar cases have different response paths. A forwarded complaint is not a confirmed removal.
The manual steps below explain those provider processes. Outtake handles the reporting workflow on supported, authorized response paths without customers filing each report themselves.
Identify the service, not just the company name
Cloudflare's abuse policy explains that most reports concern its pass-through security and content delivery network services. For those services, Cloudflare does not host the underlying content and cannot remove it from the internet.
The same policy separately describes content stored through hosting products and domains registered through Cloudflare Registrar. One provider can occupy several roles, so keep a separate evidence field for each.
| Observation | What it supports | What remains to establish |
|---|---|---|
| A Cloudflare IP appears in DNS results | Cloudflare may be proxying the site's traffic | Who hosts the underlying content |
| Cloudflare is named as the registrar in registration data | Cloudflare manages the domain registration | Where the phishing content is hosted |
| Evidence points to content stored through a Cloudflare hosting service | A hosting-related report may apply | Which exact resource is abusive and what policy action is appropriate |
| A page uses a Cloudflare-branded verification widget | The page uses that service | Whether Cloudflare is the host or registrar |
Record the source and time of each observation. Do not turn a familiar nameserver, IP address or widget into an unsupported hosting conclusion. If the origin host is unknown, say so in the case rather than guessing.
Preserve evidence before submitting
Start with the exact URL that displayed the phishing content. A domain alone may not reproduce a page located on a particular path. Preserve relevant query parameters in the restricted case record, because removing them can change the page a reviewer sees.
Prepare a compact packet containing:
- The full affected URL and the observation time, including timezone.
- Screenshots showing the copied identity and deceptive request.
- The legitimate organization or service being impersonated.
- The original distribution message or link, where available.
- Observable redirects and the final destination, captured through approved analysis methods.
- A factual description of the suspected harm, such as a copied sign-in page requesting credentials.
- The evidence supporting each infrastructure role, plus any unresolved role.
Do not enter real credentials, payment details or customer information to demonstrate that a page is malicious. Employees and customers should report what they received, not revisit the site to gather more evidence. Controlled inspection belongs with the security team.
A screenshot documents appearance at a particular time. It does not prove who operates the page, where every resource is hosted, or that information was actually stolen. Keep those conclusions separate.
Submit through the official abuse channel
Open Cloudflare's abuse reporting service from a trusted reference, choose the category that matches the observed behavior, and follow its current instructions. Report phishing as phishing rather than relying only on a statement that your logo appears without permission.
Explain what a visitor is asked to do and why the page is deceptive. For example, a report can state that the captured page presents itself as your organization and requests account credentials at a domain outside your authorized inventory. Label this as an observation, not proof of the operator's identity.
Keep a copy of the submission, its timestamp and any acknowledgement or case reference. Assign someone to receive follow-up requests. An incomplete response to a provider's evidence question can leave a report unresolved even when the original suspicion was reasonable.
Do not use a community forum as a substitute for the abuse channel. It also creates an unnecessary risk of exposing live malicious links or private evidence.
Understand forwarding and disclosure
For websites using its proxy and CDN services, Cloudflare says it forwards complaints to the website operator and hosting provider. It also provides the hosting provider with the origin IP address so that the provider can locate the content. Depending on the complaint, Cloudflare may give the reporter additional information for follow-up.
The policy says that some complaint categories let the reporter direct Cloudflare not to forward the complaint to the website operator. Do not assume that option exists for every report, or promise a reporter anonymity. Review the current submission instructions before including sensitive information.
Use an appropriate organizational contact and include only the personal data needed to explain the case. Keep complete originals internally with restricted access. When sharing a redacted copy, explain what was redacted and preserve enough technical detail for investigation. Do not paste an entire customer conversation into a report when a relevant excerpt will do.
Follow the responsible provider's response
If Cloudflare identifies an origin hosting provider, continue the case with that provider through its official abuse process. Include the relevant evidence and prior reference, and state the specific content that needs investigation. A forwarded complaint is a handoff, not a confirmed takedown.
If Cloudflare hosts the content, its policy says it can remove or disable access to content it determines violates the applicable terms. That remains a review decision, not a guaranteed outcome or fixed response time.
For domain-level phishing, assess the registrar's reporting route separately. ICANN's complaint guide distinguishes registrar and registry responsibilities from hosting. It also notes that the host or legitimate registrant may be better placed to fix a compromised website. A phishing page on a legitimate site does not automatically justify treating the whole registration as fraudulent.
ICANN contractual-compliance escalation concerns registrars and registries within its authority, not a general appeal against every hosting decision. Its guide requires reporting to the relevant registrar or registry first and allowing reasonable investigation time.
Close the case on an observed change
Track the Cloudflare report and any host or registrar report separately. Record receipt, additional-evidence requests, provider action and independent verification as different events.
Recheck the affected URL through approved methods. Describe the result precisely: a warning appeared, the specific content became unavailable, or a registration-related change occurred. Do not infer that every connected asset disappeared because one path stopped loading.
Outtake Brand Protection connects impersonation signals with hosting, registration patterns and related assets, then supports external remediation workflows. The useful connection here is investigation and coordinated response, not bypassing a provider's policies or guaranteeing its decision.
For the wider process, read the phishing takedown guide. For the evidence linking a fake page to other surfaces, see the brand impersonation guide.
Sources
- Cloudflare, Our approach to abuse.
- Cloudflare, Official abuse reporting service.
- ICANN, Submitting DNS Abuse Complaints.
- Outtake, Brand Protection.
- Outtake, Platform, evidence packaging, automated reporting, platform escalation and verified takedown.
Sources reviewed October 3, 2026.