Shut down websites hidden behind Cloudflare's proxy service

these findings might be interesting if you encounter websites hiding behind Cloudflares proxy service (I’ve been reporting around 100 fake investment scam websites in the last couple of weeks and took down around half of them up to now):

  1. If you report a website for the first time to Cloudflare: you will only get a confirmation Email about the abuse report. You will NOT get any information about the real host hidden behind CFs proxy service (that’s in their TOS nowadays)
  2. But if the website is already marked as possibly “phishing” and you report it again (from a different mail for example): you will get an answer from CF about the real host and the abuse contact Email (they changed this procedure a while ago) => helpful if you want to find out the real host and increase the pressure to him
  3. If you reported a website to Cloudflare (independent of the phishing topic from above): It’s worth checking back after a while (1-3weeks from my experience) because:
    If Cloudflare received and processed the abuse report successfully they terminate their proxy service (which usually hides the real Host) and this results in: the whois now showing the real host (so you can proceed and push the abuse report to the real host). You will NOT be notified about this by Cloudflare, you can only see these changes if you check the whois again (I use https://whois.domaintools.com/ as it reveals the ASN/IP)

@AngelFat wrote a cool summary about the different hosts already a while ago https://scammer.info/t/shutting-down-scam-websites/88306

I was collecting a couple of hosts and ways to contact them lately as well, maybe helpful for some of you [still WIP and a little chaotic, sorry for that]

Host name Website Mail Contact Online Form Remark
20i https://www.20i.com/ [email protected] no confirmation mail yet
AlexHost https://alexhost.com/ - Alexhost Abuse Report Procedure only accepts reports from authorities
Amarutu-Technology https://koddos.net/ ? [email protected] - received a ticket after mail, ticked closed w/o action
Arax-Impex s.r.l. - [email protected] - from phis.report
Aruba https://www.aruba.it/ - Report Abuse | Aruba.it confirmation after cpl of hrs, quick reaction
Asura Hosting https://www.asurahosting.com/ - Submit Ticket - Asura Hosting quick
BL Networks (?) https://blnwx.com/ [email protected], [email protected] - previous mail [email protected] not working, website blank, no confirmation
Cloudflare https://www.cloudflare.com/ https://abuse.cloudflare.com/ is a proxy, no reactions yet
Datawagon https://datawagon.com/ [email protected] Submit Ticket - DataWagon no confirmation mail via abuse mail, confirmation via form (the: report to abuse)
DigitalOcean https://www.digitalocean.com/ - Report Abuse at DigitalOcean quick feedback about abuse report
Firstcolo https://firstcolo.net/ [email protected] abuse mail not on site
Frantech Solutions https://www.frantech.ca/ - Submit Ticket - FranTech check nameservers, probably Asura Hosting
Hetzner https://www.hetzner.com/ - Hetzner | Report abuse quick confirmation mail
Host-Africa https://www.hostafrica.com/ - https://my.hostafrica.com/submitticket.php?step=2&deptid=1&_gl=1*1yl6vxy*_gcl_au*MTQ3MjA2MjMzMS4xNzM5ODkxMTQw*_ga*MTQwOTY0NzkzNi4xNzM5ODkxMTQw*_ga_423EK047KF*MTczOTg5MTE0MC4xLjEuMTczOTg5MTE4MS4wLjAuMA confirmation after 24h
Hostinger International Limited https://www.hostinger.com/ [email protected] https://www.hostinger.com/report-abuse quick (form and mail), no confirmation from online form
Hostwinds https://www.hostwinds.com/ [email protected] - correct mail accd. to chat on website, no confirmation will be sent
Interneto Vizija https://www.iv.lt/ [email protected] - confirmation mail
Limestone Networks https://www.limestonenetworks.com/ - Report Abuse | Limestone Networks
LWS https://www.lws.fr/ Où puis-je signaler un abus et / ou un spamming? - LWS Quick confirmation from form, quick reaction
Namecheap https://www.namecheap.com/ [email protected] - quick confirmation mail
Orangehost https://www.orangehost.com/ [email protected] - quick
OrangeWebsite https://orangewebsite.com/ - Submit Ticket - Orangewebsite.com asked for proof, quick after that
Ovh Hosting Inc https://www.ovhcloud.com/ - Abuse Form | OVHcloud Worldwide
Partner Hosting https://altawk.com/ [email protected] -
PhoenixNAP https://phoenixnap.com/ [email protected] [email protected] ? https://phoenixnap.com/contact-us worked, no feedback
Robotic Hosting Limited https://www.robotichosting.com/ - Submit Ticket - Robotic Hosting quick
Secured Servers LLC (?) ? - https://supportcenter.secureserver.net/abusereport/create-new-claim no website, online form maybe wrong, maybe merged with PhoenixNAP
Sharktech https://sharktech.net/ [email protected] - no feedback for abuse report
Shinjiru https://www.shinjiru.com/ [email protected] - abuse mail accd. To cloudflare
Shock Hosting https://shockhosting.com/ - Submit Ticket - Shock Hosting no confirmation mail but quick reaction
Veeble Softtech (P) Ltd. Veeble - India's Top Web Hosting Company [email protected] - quick
Vercel https://vercel.com/ Report Abuse On Vercel confirmation from form, no action after +1week
Virtual Systems LLC https://vsys.host/ [email protected] - report in UKR + ENG
Virtualine https://www.virtualine.net/ - Open Ticket - Virtualine Technologies quick confirmation mail
Virtuo Networks France SAS https://virtuo.host/ [email protected] Virtuo.host - Contact us mail rejected by Spam filter, form doesn’t work
WebHostingBuzz https://webhostingbuzz.com/ [email protected] no confirmation mail, send 2nd mail to [email protected] (ticked opened)
WPX (K Media Tech Ltd.) https://wpx.net/ [email protected] - quick confirmation mail
2 Likes