# Phishing sites impersonating Cloudflare PhishDestroy has recorded 2,017 phishing domains impersonating Cloudflare since 2024-03-24, 58 of them in the last 30 days. The most used registrars are Cloudflare Pages and Cloudflare; the most common TLDs are .dev and .com. The official Cloudflare domain is cloudflare.com: any other site asking for your login or wallet is not Cloudflare. 2,017Domains, all time 58Last 30 days 952Online at last check 203Confirmed takedowns ## New domains in the last 90 days Cloudflare phishing domains detected per day: 929 from 2026-07-25 to 2026-10-22; peak 69. ## How to tell a fake Cloudflare site Official domain: cloudflare.com. Words most often added to the brand in reported domains: biz, cryptolist, arweave, ledgr, account, claim, business, next, start, blue. - Type the address yourself or use a bookmark; phishing links for Cloudflare arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - Cloudflare will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest Cloudflare phishing domains The 50 most recently detected domains impersonating Cloudflare Domain | First detected | Status at last check | Registrar | [mrking100082.com](https://phishdestroy.io/domain/mrking100082.com/) | 2026-10-18 | Offline | Key-Systems | [mrking100084.com](https://phishdestroy.io/domain/mrking100084.com/) | 2026-10-18 | Offline | Key-Systems | [ik-press.com](https://phishdestroy.io/domain/ik-press.com/) | 2026-10-18 | Online | NICENIC | [mrking100580.com](https://phishdestroy.io/domain/mrking100580.com/) | 2026-10-18 | Unknown | NICENIC | [mrking21058.com](https://phishdestroy.io/domain/mrking21058.com/) | 2026-10-17 | Unknown | NICENIC | [madirdbet4035.cam](https://phishdestroy.io/domain/madirdbet4035.cam/) | 2026-10-17 | Online | Spaceship | [mriking10059.com](https://phishdestroy.io/domain/mriking10059.com/) | 2026-10-17 | Offline | NICENIC | [kingroyal2137.com](https://phishdestroy.io/domain/kingroyal2137.com/) | 2026-10-17 | Online | Spaceship | [mrking11860.com](https://phishdestroy.io/domain/mrking11860.com/) | 2026-10-16 | Unknown | NICENIC | [mrking010059.com](https://phishdestroy.io/domain/mrking010059.com/) | 2026-10-16 | Unknown | NICENIC | [mrking11075.com](https://phishdestroy.io/domain/mrking11075.com/) | 2026-10-16 | Online | Registrar.eu | [mrking10055.co](https://phishdestroy.io/domain/mrking10055.co/) | 2026-10-15 | Online | NameSilo | [mrking10056.co](https://phishdestroy.io/domain/mrking10056.co/) | 2026-10-15 | Online | — | [mrking10058.co](https://phishdestroy.io/domain/mrking10058.co/) | 2026-10-14 | Offline | — | [mriking10057.com](https://phishdestroy.io/domain/mriking10057.com/) | 2026-10-14 | Unknown | NICENIC | [mrking010058.com](https://phishdestroy.io/domain/mrking010058.com/) | 2026-10-14 | Offline | NICENIC | [mrking100588.com](https://phishdestroy.io/domain/mrking100588.com/) | 2026-10-14 | Offline | NICENIC | [mrking50063.com](https://phishdestroy.io/domain/mrking50063.com/) | 2026-10-13 | Offline | Spaceship | [mrking11073.com](https://phishdestroy.io/domain/mrking11073.com/) | 2026-10-13 | Online | Registrar.eu | [mrking55091.com](https://phishdestroy.io/domain/mrking55091.com/) | 2026-10-13 | Offline | NICENIC | [mrking10507.com](https://phishdestroy.io/domain/mrking10507.com/) | 2026-10-13 | Offline | NICENIC | [uphold-rewardsvault.com](https://phishdestroy.io/domain/uphold-rewardsvault.com/) | 2026-10-13 | Online | NICENIC | [opentrustcardwallet.sbs](https://phishdestroy.io/domain/opentrustcardwallet.sbs/) | 2026-10-13 | Online | NICENIC | [opentrustcardwallet.icu](https://phishdestroy.io/domain/opentrustcardwallet.icu/) | 2026-10-13 | Online | NICENIC | [mrking10888.com](https://phishdestroy.io/domain/mrking10888.com/) | 2026-10-12 | Online | Dynadot | [5695mrking.com](https://phishdestroy.io/domain/5695mrking.com/) | 2026-10-12 | Online | Registrar.eu | [mrking1000057.com](https://phishdestroy.io/domain/mrking1000057.com/) | 2026-10-12 | Unknown | NICENIC | [app-changelly.net](https://phishdestroy.io/domain/app-changelly.net/) | 2026-10-12 | Online | Registrar.eu | [82194.shop](https://phishdestroy.io/domain/82194.shop/) | 2026-10-10 | Offline | Registrar.eu | [elster.de-189980.cc](https://phishdestroy.io/domain/elster.de-189980.cc/) | 2026-10-09 | Online | NICENIC | [nug2mr8.kalviro.top](https://phishdestroy.io/domain/nug2mr8.kalviro.top/) | 2026-10-08 | Online | Openprovider | [tornado-cash.net](https://phishdestroy.io/domain/tornado-cash.net/) | 2026-10-07 | Online | Registrar.eu | [v2-tornadocash.com](https://phishdestroy.io/domain/v2-tornadocash.com/) | 2026-10-07 | Online | NameSilo | [mllleraleh00use.delivery](https://phishdestroy.io/domain/mllleraleh00use.delivery/) | 2026-10-07 | Online | NICENIC | [allocate-stockereum.icu](https://phishdestroy.io/domain/allocate-stockereum.icu/) | 2026-10-07 | Offline | NICENIC | [betparibuhosgeldin.com](https://phishdestroy.io/domain/betparibuhosgeldin.com/) | 2026-10-07 | Offline | NICENIC | [kenda-najd.com](https://phishdestroy.io/domain/kenda-najd.com/) | 2026-10-07 | Online | Cloudflare | [aijrpd.payden-qt.com](https://phishdestroy.io/domain/aijrpd.payden-qt.com/) | 2026-10-07 | Online | Dominet (HK) | [zwina.co](https://phishdestroy.io/domain/zwina.co/) | 2026-10-07 | Offline | GoDaddy.com | [cloud-files.download](https://phishdestroy.io/domain/cloud-files.download/) | 2026-10-06 | Online | Cloudflare | [detixbit.com](https://phishdestroy.io/domain/detixbit.com/) | 2026-10-05 | Unknown | NICENIC | [fatowin.com](https://phishdestroy.io/domain/fatowin.com/) | 2026-10-04 | Online | Trustname.com | [xfhfstore.com](https://phishdestroy.io/domain/xfhfstore.com/) | 2026-10-03 | Online | DNC Holdings | [gfo-ltd.com](https://phishdestroy.io/domain/gfo-ltd.com/) | 2026-09-30 | Online | Name SRS | [cloudfalre.net](https://phishdestroy.io/domain/cloudfalre.net/) | 2026-09-29 | Online | NICENIC | [ai-bot-mining.vip](https://phishdestroy.io/domain/ai-bot-mining.vip/) | 2026-09-29 | Online | Dynadot | [ai-bot-mining.top](https://phishdestroy.io/domain/ai-bot-mining.top/) | 2026-09-29 | Offline | Gname.com | [xiaomi6.vip](https://phishdestroy.io/domain/xiaomi6.vip/) | 2026-09-29 | Online | Gname.com | [jerrycvv.com](https://phishdestroy.io/domain/jerrycvv.com/) | 2026-09-28 | Online | DotWee | [dapp-tronlink.com](https://phishdestroy.io/domain/dapp-tronlink.com/) | 2026-09-27 | Offline | Dominet (HK) | [All 2,017 Cloudflare reports](https://phishdestroy.io/domain/?brand=Cloudflare) ## Where they are registered and hosted ### Registrars - Cloudflare Pages549 - Cloudflare240 - [NICENIC](https://phishdestroy.io/registrar/nicenic/)143 - [NameCheap](https://phishdestroy.io/registrar/namecheap/)96 - [Key-Systems](https://phishdestroy.io/registrar/key-systems/)88 - [PublicDomainRegistry.com](https://phishdestroy.io/registrar/publicdomainregistry-pdr/)58 - [Dynadot](https://phishdestroy.io/registrar/dynadot/)50 - [NiceNIC](https://phishdestroy.io/registrar/nicenic/)49 ### Top-level domains - [.dev](https://phishdestroy.io/tld/dev/)776 - [.com](https://phishdestroy.io/tld/com/)501 - [.net](https://phishdestroy.io/tld/net/)149 - [.org](https://phishdestroy.io/tld/org/)57 - [.xyz](https://phishdestroy.io/tld/xyz/)52 - [.io](https://phishdestroy.io/tld/io/)42 - [.live](https://phishdestroy.io/tld/live/)39 - [.cc](https://phishdestroy.io/tld/cc/)29 ### Hosting networks - Cloudflare, Inc.1,344 - CLOUDFLARENET - Cloudflare, Inc., US267 - CLOUDFLARENET, US252 - Datacamp Limited57 - AS13335 Cloudflare, Inc.34 - Cloudflare London, LLC9 - GMO Internet, Inc.7 - Amazon.com, Inc.7 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Wallet drainer](https://phishdestroy.io/glossary/wallet-drainer/) - [Seed phrase phishing](https://phishdestroy.io/glossary/seed-phrase-phishing/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Cloudflare; share of all PhishDestroy reports: 0.90%. Canonical: https://phishdestroy.io/brand/cloudflare/