How to Report a Fake Website Hidden Behind Cloudflare

You found it. A website using your brand name, your logo, maybe even your product images, and it's selling counterfeits or collecting customer data under your identity. You run a WHOIS lookup to find out who registered it and where it's hosted, and every result points back to Cloudflare's IP addresses. The actual owner? Hidden.

This is one of the most common frustrations brands face when trying to take down fake websites. Cloudflare is a legitimate content delivery and security network used by millions of websites worldwide. Scammers use it specifically because it masks the origin server's IP address, making it harder to identify the real hosting provider quickly.

The good news: Cloudflare has an abuse reporting process, and there are parallel enforcement paths that don't depend on Cloudflare acting alone. Here is exactly what to do.

Key point: Cloudflare is not the host in most cases. It is a pass-through security and CDN layer. That distinction shapes every step of the reporting process.

Why Cloudflare Makes Fake Sites Harder to Take Down

When a website sits behind Cloudflare, all traffic routes through Cloudflare's network first. This means the IP address you see in WHOIS records and DNS lookups belongs to Cloudflare, not the actual server running the fake site.

Scammers know this. By signing up for Cloudflare's free plan, they effectively put a privacy shield in front of their operation. Standard enforcement routes, like sending a legal notice directly to a hosting provider, require knowing who that hosting provider is. Cloudflare's CDN layer makes that first step much harder.

What Cloudflare can and cannot do

Understanding Cloudflare's actual role prevents wasted effort:

• Cloudflare cannot remove content from the internet that it does not host
• Cloudflare can forward your abuse complaint to the website operator and the underlying hosting provider
• Cloudflare can provide the origin server's IP address to the hosting provider when you submit a valid report
• For phishing reports specifically, Cloudflare can add a warning page for visitors accessing the phishing link after confirming the report
• For trademark infringement, Cloudflare only processes reports from trademark holders or their legally authorized representatives

This is not a dead end. It means your report to Cloudflare is one step in a multi-channel enforcement process, not the whole process.

Step 1: Document the Fake Website Before Reporting

Before you file anything, gather evidence. Reports without supporting documentation are frequently rejected or deprioritized. Take the time to build a complete record.

What to capture

• Full URL(s) of the infringing pages, not just the homepage
• Screenshots showing your brand name, logo, product images, or trademark being used without authorization
• Date and time stamps on all screenshots (use your browser's developer tools or a timestamping service)
• WHOIS record for the domain, even if it shows Cloudflare's details, as this confirms Cloudflare is involved.
• Evidence of your ownership, such as your registered trademark number, your official domain, or links to your original copyrighted content
• Description of the harm, whether it is counterfeit product sales, phishing, impersonation, or unauthorized use of intellectual property

The stronger your documentation, the faster Cloudflare and the downstream hosting provider can act. Vague reports get forwarded and ignored. Specific, well-evidenced reports get escalated.

Step 2: Submit an Abuse Report to Cloudflare

Cloudflare's abuse reporting form is the correct channel. Do not email them directly; Cloudflare explicitly states that emailed complaints are not processed and will receive an automated redirect to the form.

Choosing the right abuse category

When completing the form, select the category that best matches your situation:

• Trademark Infringement for unauthorized use of your brand name, logo, or registered marks (note: Cloudflare only processes these from trademark holders or authorized representatives)
• Copyright Infringement and DMCA Violations for unauthorized use of copyrighted images, text, or product content
• Phishing and Malware if the fake site is designed to steal customer credentials or payment details
• General for other unlawful content not covered by the above categories

What a DMCA-compliant report must include

For copyright infringement specifically, Cloudflare requires all of the following to process the report:

• Your physical or electronic signature (typing your full name is accepted)
• Identification of the copyrighted work being infringed
• The specific URL of the infringing material on the fake website
• Your contact information: name, address, phone number, and email address
• A good-faith statement that the use is not authorized by the copyright owner or law
• A statement, under penalty of perjury, confirming you are authorized to act on behalf of the copyright owner

Missing any of these items means Cloudflare cannot process the report. Get them all in on the first submission.

What happens after you submit

Cloudflare will forward your complaint to both the website operator and the underlying hosting provider. For CDN-proxied sites (the majority of cases), Cloudflare will also provide the hosting provider with the origin server's IP address. This is the key outcome: it gives the actual host what they need to locate and act on the infringing content.

Step 3: Run Parallel Enforcement Actions

Reporting to Cloudflare is necessary but not sufficient on its own. Running parallel actions at the same time increases the pressure on the fake site from multiple directions.

Report to Google Search

If the fake site appears in Google search results, you can request its de-indexing through Google's Search Console reporting tools. Removing a fake site from search results cuts off a major source of traffic to it, even if the site itself remains live temporarily.

Contact the domain registrar

Check the WHOIS record for the registrar of the domain (separate from the hosting provider). Most registrars have abuse policies that cover trademark infringement and phishing. File a complaint directly with the registrar in parallel with your Cloudflare report.

Report to national cybercrime authorities

If the fake site is collecting payment information or impersonating your brand to defraud consumers, this may constitute fraud under applicable law. In the US, reports can be filed with the FBI's Internet Crime Complaint Center (IC3). In the EU, your national cybercrime unit is the appropriate authority.

Send a cease and desist to the registrant

Even if the registrant's contact details are privacy-protected, the registrar is required under ICANN policy to forward legal correspondence to the registrant. A cease and desist letter, sent through the registrar, creates a formal legal record and often prompts faster action than an abuse report alone.

The Bigger Problem: You Only Found One

Most brands that discover one fake website find more when they start looking properly. Scammers who build one impersonation site typically run several, rotating domains as they get taken down.

The manual process of searching for fake websites, identifying Cloudflare-proxied domains, gathering evidence, filing reports, and following up across multiple channels is genuinely time-consuming. For a brand operating at scale, it is not sustainable as a reactive, case-by-case effort.

This is exactly the problem Remove.tech's brand protection platform is built to solve.

Remove.tech monitors search engines, marketplaces, domain registrars, and websites around the clock, scanning for potential infringements including fake websites, counterfeit product listings, and brand impersonations. When the platform detects something, it validates the finding and can automatically initiate takedown proceedings, without waiting for a team member to notice the problem first.

The platform's automated systems have the potential to boost takedown rates by up to 3-5 times compared to manual processes, according to Remove.tech's own data. For brands dealing with repeat offenders who simply re-register new domains after takedowns, that speed of detection and response is the difference between a contained problem and an ongoing one.

If you want to see what is currently out there using your brand without authorization, Remove.tech offers a free brand audit with no obligation. It takes around two minutes to request and covers search engines, websites, and marketplaces.

FAQ

Can Cloudflare take down a fake website?

Cloudflare can act on content it directly hosts (through services like Cloudflare Pages or Cloudflare Stream), but the vast majority of fake websites use Cloudflare as a CDN and pass-through security layer only. In those cases, Cloudflare cannot remove the content itself. It can forward your complaint to the hosting provider and website operator, and it can provide the hosting provider with the origin server's IP address to help locate the content.

How do I know if a fake website is behind Cloudflare?

Run a WHOIS lookup on the domain. If the IP address in the DNS records resolves to Cloudflare's network ranges, the site is using Cloudflare's CDN services. You can also use tools like MXToolbox to check DNS records and confirm Cloudflare's presence.

How long does a Cloudflare abuse report take to process?

Cloudflare does not publish specific processing timeframes. Submitting a complete, well-documented report through the online form (not by email) gives you the best chance of a prompt response. Incomplete reports are delayed or rejected.

What if the fake website comes back after being taken down?

This is common. Scammers re-register new domains quickly after takedowns. The only reliable way to stay ahead of it is continuous monitoring. Remove.tech's brand protection platform monitors domain registrars and the wider web around the clock, detecting new impersonation attempts as they appear rather than after they have already caused damage.

Does Remove.tech handle Cloudflare-protected fake websites?

Yes. Remove.tech's brand protection software detects fake websites regardless of the CDN or security layer they sit behind. The platform identifies infringing domains and websites through search engine monitoring, domain registrar scanning, and web crawling, then initiates the appropriate takedown process across all relevant channels.

Do I need a registered trademark to report a fake website?

For trademark infringement reports specifically, Cloudflare only processes complaints from trademark holders or their authorized legal representatives. For copyright infringement (unauthorized use of your images, text, or other copyrighted content), you do not need a registered trademark, but you do need to be the copyright owner or an authorized representative. For phishing reports, no trademark registration is required.

‍