Phishing sites impersonating Cloudflare

PhishDestroy has recorded 2,017 phishing domains impersonating Cloudflare since 2024-03-24, 58 of them in the last 30 days. The most used registrars are Cloudflare Pages and Cloudflare; the most common TLDs are .dev and .com. The official Cloudflare domain is cloudflare.com: any other site asking for your login or wallet is not Cloudflare.

2,017
Domains, all time
58
Last 30 days
952
Online at last check
203
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 32026-07-26: 82026-07-27: 252026-07-28: 512026-07-29: 82026-07-30: 52026-07-31: 72026-08-01: 92026-08-02: 142026-08-03: 102026-08-04: 152026-08-05: 332026-08-06: 122026-08-07: 282026-08-08: 152026-08-09: 402026-08-10: 692026-08-11: 192026-08-12: 152026-08-13: 372026-08-14: 72026-08-15: 132026-08-16: 202026-08-17: 412026-08-18: 122026-08-19: 42026-08-20: 192026-08-21: 242026-08-22: 102026-08-23: 62026-08-24: 62026-08-25: 62026-08-26: 142026-08-27: 42026-08-28: 92026-08-29: 22026-08-30: 32026-08-31: 262026-09-01: 622026-09-02: 42026-09-03: 92026-09-04: 42026-09-05: 112026-09-06: 152026-09-07: 122026-09-08: 492026-09-09: 72026-09-10: 72026-09-11: 52026-09-12: 42026-09-13: 02026-09-14: 72026-09-15: 72026-09-16: 12026-09-17: 72026-09-18: 92026-09-19: 02026-09-20: 22026-09-21: 02026-09-22: 02026-09-23: 12026-09-24: 32026-09-25: 12026-09-26: 02026-09-27: 42026-09-28: 12026-09-29: 42026-09-30: 12026-10-01: 02026-10-02: 02026-10-03: 12026-10-04: 12026-10-05: 12026-10-06: 12026-10-07: 82026-10-08: 12026-10-09: 12026-10-10: 12026-10-11: 02026-10-12: 42026-10-13: 72026-10-14: 42026-10-15: 22026-10-16: 32026-10-17: 42026-10-18: 42026-10-19: 02026-10-20: 02026-10-21: 02026-10-22: 0
Cloudflare phishing domains detected per day: 929 from 2026-07-25 to 2026-10-22; peak 69.

How to tell a fake Cloudflare site

Official domain: cloudflare.com.

Words most often added to the brand in reported domains: biz, cryptolist, arweave, ledgr, account, claim, business, next, start, blue.

  • Type the address yourself or use a bookmark; phishing links for Cloudflare arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Cloudflare will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Cloudflare phishing domains

The 50 most recently detected domains impersonating Cloudflare
DomainFirst detectedStatus at last checkRegistrar
mrking100082.com2026-10-18OfflineKey-Systems
mrking100084.com2026-10-18OfflineKey-Systems
ik-press.com2026-10-18OnlineNICENIC
mrking100580.com2026-10-18UnknownNICENIC
mrking21058.com2026-10-17UnknownNICENIC
madirdbet4035.cam2026-10-17OnlineSpaceship
mriking10059.com2026-10-17OfflineNICENIC
kingroyal2137.com2026-10-17OnlineSpaceship
mrking11860.com2026-10-16UnknownNICENIC
mrking010059.com2026-10-16UnknownNICENIC
mrking11075.com2026-10-16OnlineRegistrar.eu
mrking10055.co2026-10-15OnlineNameSilo
mrking10056.co2026-10-15Online—
mrking10058.co2026-10-14Offline—
mriking10057.com2026-10-14UnknownNICENIC
mrking010058.com2026-10-14OfflineNICENIC
mrking100588.com2026-10-14OfflineNICENIC
mrking50063.com2026-10-13OfflineSpaceship
mrking11073.com2026-10-13OnlineRegistrar.eu
mrking55091.com2026-10-13OfflineNICENIC
mrking10507.com2026-10-13OfflineNICENIC
uphold-rewardsvault.com2026-10-13OnlineNICENIC
opentrustcardwallet.sbs2026-10-13OnlineNICENIC
opentrustcardwallet.icu2026-10-13OnlineNICENIC
mrking10888.com2026-10-12OnlineDynadot
5695mrking.com2026-10-12OnlineRegistrar.eu
mrking1000057.com2026-10-12UnknownNICENIC
app-changelly.net2026-10-12OnlineRegistrar.eu
82194.shop2026-10-10OfflineRegistrar.eu
elster.de-189980.cc2026-10-09OnlineNICENIC
nug2mr8.kalviro.top2026-10-08OnlineOpenprovider
tornado-cash.net2026-10-07OnlineRegistrar.eu
v2-tornadocash.com2026-10-07OnlineNameSilo
mllleraleh00use.delivery2026-10-07OnlineNICENIC
allocate-stockereum.icu2026-10-07OfflineNICENIC
betparibuhosgeldin.com2026-10-07OfflineNICENIC
kenda-najd.com2026-10-07OnlineCloudflare
aijrpd.payden-qt.com2026-10-07OnlineDominet (HK)
zwina.co2026-10-07OfflineGoDaddy.com
cloud-files.download2026-10-06OnlineCloudflare
detixbit.com2026-10-05UnknownNICENIC
fatowin.com2026-10-04OnlineTrustname.com
xfhfstore.com2026-10-03OnlineDNC Holdings
gfo-ltd.com2026-09-30OnlineName SRS
cloudfalre.net2026-09-29OnlineNICENIC
ai-bot-mining.vip2026-09-29OnlineDynadot
ai-bot-mining.top2026-09-29OfflineGname.com
xiaomi6.vip2026-09-29OnlineGname.com
jerrycvv.com2026-09-28OnlineDotWee
dapp-tronlink.com2026-09-27OfflineDominet (HK)

All 2,017 Cloudflare reports

Where they are registered and hosted

Registrars

  1. Cloudflare Pages549
  2. Cloudflare240
  3. NICENIC143
  4. NameCheap96
  5. Key-Systems88
  6. PublicDomainRegistry.com58
  7. Dynadot50
  8. NiceNIC49

Top-level domains

  1. .dev776
  2. .com501
  3. .net149
  4. .org57
  5. .xyz52
  6. .io42
  7. .live39
  8. .cc29

Hosting networks

  1. Cloudflare, Inc.1,344
  2. CLOUDFLARENET - Cloudflare, Inc., US267
  3. CLOUDFLARENET, US252
  4. Datacamp Limited57
  5. AS13335 Cloudflare, Inc.34
  6. Cloudflare London, LLC9
  7. GMO Internet, Inc.7
  8. Amazon.com, Inc.7

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Cloudflare; share of all PhishDestroy reports: 0.90%.