Cloudflare phishing & impersonation
Tech & Cloudcloudflare.com
25
Sites impersonating it
19
New in the last 30 days
6
Campaigns
2026-10-28
Last detected
2026-07-312026-10-28
Where these sites are hosted
19 on free hosting platforms, 6 on 6 registered domains
workers.dev · 12pages.dev · 5eu.org · 1r2.dev · 1.com · 3.bz · 1.cfd · 1.xyz · 1
Campaigns
Phishing kits we track as hunts, and how many of the sites below each one covers. A site can belong to more than one.
Self-hosted Turnstile gate kit — five-dot "Just a moment....." cfForm gate (YARA content anchor)high
12 of 25 sites · last 2026-10-26
1 of 25 site · last 2026-10-24
1 of 25 site · last 2026-10-11
1 of 25 site · last 2026-10-11
1 of 25 site · last 2026-10-11
DarkSword iOS exploit kit: fake captcha gate with a hidden exploit iframe (Coruna wallet stealer)critical
1 of 25 site · last 2026-10-09
Official domains
cloudflare.com
A match on a host outside these domains is recorded as impersonation. We look for the brand name in the address, page title and screenshot, its logo on a non-official site, and our AI analysis naming it.
Sites impersonating Cloudflare
25 of 25 sites · newest first · repeat scans of a site are grouped
549 lower-risk copies are not shown: sites that use the Cloudflare name or design, but that neither our rule engine nor our AI analysis rates high risk (for example harmless copies of the brand's own pages). Show them
bright-heron-3918-12773285.pages. dev Prueba de velocidad de Internet - Mide el rendimiento de red | Cloudflare2026-10-26 · seen 3×RulesMaliciousAIHigh Risk“Cloudflare” in the page titleAI analysis
RulesHigh RiskAIHigh RiskKnown Kit: Self-hosted Turnstile gate kit — five-dot "Just a moment....." cfForm gate (YARA content anchor) (turnstile-gate-kit-202609)Identical to a page confirmed as CloudflareIdentical page
RulesLow RiskAIHigh Risk“Cloudflare” in the page titleAI analysis
RulesHigh RiskAIHigh RiskIdentified as Cloudflare by our AI analysisAI analysis
RulesHigh RiskAIHigh RiskKnown Kit: Self-hosted Turnstile gate kit — five-dot "Just a moment....." cfForm gate (YARA content anchor) (turnstile-gate-kit-202609)Identical to a page confirmed as CloudflareIdentical page
RulesHigh RiskAIHigh RiskKnown Kit: Self-hosted Turnstile gate kit — five-dot "Just a moment....." cfForm gate (YARA content anchor) (turnstile-gate-kit-202609)Identical to a page confirmed as CloudflareIdentical page
coral-brook-c6d8.pages. dev Internet Speed Test - Misura le prestazioni di rete | Cloudflare2026-10-24RulesMaliciousAIHigh Risk“Cloudflare” in the page titleAI analysis
RulesMaliciousAIHigh Risk“Cloudflare” in the page titleAI analysis
dewy-valley-7a40-8be89da9.pages. dev インターネットスピードテスト - ネットワークパフォーマンスの測定 | Cloudflare2026-10-23 · seen 3×RulesMaliciousAIHigh Risk“Cloudflare” in the page titleAI analysis
5t2or9f9n48-rui9a4m0cxntn1vap9sk.kilo74mm. workers. dev. ircc1. eu. org Internet Speed Test - Measure Network Performance | Cloudflare2026-10-23RulesLow RiskAIHigh Risk“Cloudflare” in the page titleAI analysis
RulesHigh RiskAIHigh RiskKnown Kit: Self-hosted Turnstile gate kit — five-dot "Just a moment....." cfForm gate (YARA content anchor) (turnstile-gate-kit-202609)Identified as Cloudflare by our AI analysisAI analysisIdentical page
RulesHigh RiskAIHigh RiskKnown Kit: Self-hosted Turnstile gate kit — five-dot "Just a moment....." cfForm gate (YARA content anchor) (turnstile-gate-kit-202609)Identified as Cloudflare by our AI analysisAI analysis
RulesHigh RiskAIHigh RiskKnown Kit: Self-hosted Turnstile gate kit — five-dot "Just a moment....." cfForm gate (YARA content anchor) (turnstile-gate-kit-202609)Identified as Cloudflare by our AI analysisAI analysisIdentical page
RulesHigh RiskAIHigh RiskKnown Kit: Self-hosted Turnstile gate kit — five-dot "Just a moment....." cfForm gate (YARA content anchor) (turnstile-gate-kit-202609)Identical to a page confirmed as CloudflareIdentical page
RulesHigh RiskAIHigh RiskKnown Kit: Self-hosted Turnstile gate kit — five-dot "Just a moment....." cfForm gate (YARA content anchor) (turnstile-gate-kit-202609)Identical to a page confirmed as CloudflareIdentical page
RulesHigh RiskAIHigh RiskKnown Kit: Self-hosted Turnstile gate kit — five-dot "Just a moment....." cfForm gate (YARA content anchor) (turnstile-gate-kit-202609)Identical to a page confirmed as CloudflareIdentical page
RulesHigh RiskAIHigh RiskKnown Kit: Self-hosted Turnstile gate kit — five-dot "Just a moment....." cfForm gate (YARA content anchor) (turnstile-gate-kit-202609)Identical to a page confirmed as CloudflareIdentical page
RulesHigh RiskAIHigh RiskKnown Kit: Self-hosted Turnstile gate kit — five-dot "Just a moment....." cfForm gate (YARA content anchor) (turnstile-gate-kit-202609)Identical to a page confirmed as CloudflareIdentical page
RulesHigh RiskAIHigh RiskKnown Kit: Self-hosted Turnstile gate kit — five-dot "Just a moment....." cfForm gate (YARA content anchor) (turnstile-gate-kit-202609)Identified as Cloudflare by our AI analysisAI analysis
RulesMedium RiskAIHigh RiskIdentified as Cloudflare by our AI analysisAI analysis
RulesLow RiskAIHigh Risk“Cloudflare” in the page titleAI analysis- RulesLow RiskAIHigh RiskIdentified as Cloudflare by our AI analysisAI analysis
RulesLow RiskAIHigh Risk“Cloudflare” in the page titleAI analysis
RulesMaliciousAIHigh RiskKnown Kit: ClickFix FakeCAPTCHA — LOLBin variant (msiexec/mshta/wmic/etc.) (clickfix-fakecaptcha)“Cloudflare” in the hostnameAI analysis
rne8b0wt5znenjp.xyz 2026-09-14RulesMaliciousAIHigh RiskKnown Kit: DarkSword iOS exploit kit: fake captcha gate with a hidden exploit iframe (Coruna wallet stealer) (darksword-ios-exploit-2026-10)Identified as Cloudflare by our AI analysisAI analysis
96 further sites are not listed at all: the Cloudflare name appeared on them, but we judged them not to be impersonation (both our rule engine and our AI analysis rated the page harmless, the page only mentions the brand, or it is a copy of another public website).