service-cloudflare[.]com

PhishDestroy identifies service-cloudflare.com as an active Cloudflare credential harvesting site posing as the legitimate Cloudflare service. This domain mimics official branding to trick users into entering login credentials or sensitive payment information, with threat actors leveraging Cloudflare’s trusted reputation to bypass security filters. The fraudulent domain was registered through Cloudflare’s own registrar on March 30, 2026, a highly unusual and suspicious practice that raises immediate red flags for domain authenticity. Security intelligence confirms this domain resolves to IP 38.54.108.85, uses a Let’s Encrypt SSL certificate, and has already been blocked by two major phishing blocklists: OpenPhish and PhishingArmy.

VirusTotal analysis reveals that 13 out of 95 security vendors have flagged service-cloudflare.com as malicious, indicating elevated threat potential with confirmed phishing activity targeting Cloudflare users. The domain’s recent creation date—just days ago—combined with its registration through Cloudflare’s own registrar, suggests a coordinated impersonation campaign likely launched to exploit users during a period of low scrutiny. This tactic is consistent with advanced phishing operations that abuse trusted infrastructure to increase credibility and evade detection by automated security systems.

If you visited service-cloudflare.com or entered any credentials, immediately change your Cloudflare account password and enable two-factor authentication. Scan your device for malware using a reputable antivirus tool such as Malwarebytes or Windows Defender. Report the domain to Cloudflare’s abuse team and your IT administrator if on a corporate network. Avoid clicking any links or downloading files from this domain. Monitor financial accounts and enable transaction alerts. For future protection, bookmark the official Cloudflare login page at cloudflare.com/login and verify URLs carefully before entering credentials. Stay vigilant—this domain is actively malicious and should be treated as a confirmed phishing threat.