How to report a phishing site to Cloudflare

How to reach them

Cloudflare says it generally cannot process complaints sent by email (including to [email protected]); emails get an automatic reply pointing to the form. Use the form.

Cloudflare owns the parent domain of these addresses, so it can remove a page on any of them directly:

• *.pages.dev

• Choose the Phishing & Malware category
• For a site Cloudflare only proxies, it forwards your report to the site operator and the hosting provider

Reporting to Cloudflare, step by step

1. Copy the exact address of the scam page, not just the home page. Cloudflare's docs say parts of one website can sit with different providers, and show how to find the direct link of an image or video with the browser's developer tools.
2. Open Cloudflare's abuse form at abuse.cloudflare.com. Cloudflare calls the form the primary way to report abuse to it.
3. Pick the "Phishing & Malware" category. Cloudflare lists it among the categories to use when its IP address appears in a website's WHOIS and DNS records.
4. Enter the domain and the full link to the phishing page, then submit.
5. Do not send the complaint by email. Cloudflare says it is generally unable to process emailed complaints and that you will likely get an automatic reply sending you back to the form. Cloudflare also warns that reports by post to its Legal Department cause significant delays.

What Cloudflare asks you to include

• Cloudflare's docs say a valid phishing report must give the domain in question and the specific link to the phishing page.
• Cloudflare asks for the most specific URL you can find, such as the direct link to an image or iframe, so it can tell which of its services touch that content.
• Cloudflare says that for some complaint categories you can tell it not to forward your report to the website operator. Look for that choice on the form before you submit.

What Cloudflare can do

• For a proxied site, Cloudflare says it forwards your complaint to the website operator and the hosting provider, and gives the hosting provider the origin IP address so it can find the content.
• Once Cloudflare confirms a phishing page exists, it says it shows a warning page to visitors of that link and tells the site owner to clean the malicious files from the origin server.
• Cloudflare says legitimate reports of malware URLs are blocked from loading through Cloudflare.
• For content stored on Pages, Workers, Workers KV, Stream or Images, Cloudflare says it will remove or disable access when the content breaks its supplemental terms. Its list of content it may block or remove includes content that seeks to defraud the public.
• Cloudflare says it may suspend or terminate hosting services used repeatedly to store violating content when nothing meaningful was done to fix it.

What Cloudflare cannot do

• Cloudflare says it cannot remove from the Internet content that it does not host. For a site that only uses Cloudflare's proxy and CDN, the page stays up until the operator or the real host takes it down.
• Cloudflare says terminating its security services is not normally an appropriate or effective response to abuse, and that it ends those services only in narrowly defined circumstances.

What happens after you report

• For proxied sites, Cloudflare says that depending on the complaint it may reply with extra details so you can follow up yourself.
• Cloudflare's Trust & Safety team sends reports to the domain owner or the abuse contact on the customer's account. If the customer has no monitored abuse contact, Cloudflare says it sends the report to the hosting provider.
• Cloudflare tells its customers to answer abuse notifications within 24 hours, and says failure to respond or fix the problem may lead to the content being removed or blocked and the account's services being suspended or terminated.
• When Cloudflare removes or disables content it hosts, it says it generally notifies the website operator and may restore the content if the operator's response justifies it.

Write the report

Paste the link, phone number or email address and we'll write the message for Cloudflare. You send it yourself.

Is the domain also registered with Cloudflare Registrar?

This page is about content on Cloudflare's servers. If the domain name itself is registered with Cloudflare Registrar (the Registrar line in a WHOIS lookup shows it), the registrar route is the one that can suspend the name. Report to both when the same company does both jobs.

Not sure who hosts the site?

Scan it: we'll identify the host and registrar and give you the routes that apply.