Cloudflare
Cloudflare is the most widely deployed CDN, WAF and DDoS-mitigation network on the public web, proxying a large share of all HTTP traffic. Because it terminates connections at the edge, a scan of a Cloudflare-fronted site often captures a Cloudflare challenge, CAPTCHA or block page rather than the origin’s real content.
For security analysis that edge layer cuts both ways. It hides the origin IP and shields sites from many automated tools, but it is also heavily abused: phishing kits and malware landing pages routinely sit behind Cloudflare to dodge takedowns and crawlers. Treat the presence of Cloudflare as a routing fact, not a safety signal — the verdict comes from what the page actually does.
Commonly deployed alongside Cloudflare
Of the 102,902 public scans where Cloudflare was detected, these are the technologies most often present on the same site. The share is the percentage of Cloudflare sites that also ran each one.
| Technology | Category | Share of Cloudflare sites |
|---|---|---|
| Cloudflare Bot Management | wappalyzer | 86.1% |
| HTTP/3 | wappalyzer | 59.67% |
| X-UA-Compatible | miscellaneous | 33.6% |
| Open-Graph-Protocol | miscellaneous | 29.4% |
| HSTS | wappalyzer | 28.83% |
| jQuery | wappalyzer | 24.5% |
| Google Analytics | wappalyzer | 22.18% |
| JQuery | miscellaneous | 20.4% |
| PHP | wappalyzer | 16.83% |
| WordPress | cms | 15.71% |
| MetaGenerator | miscellaneous | 15.66% |
| Google Tag Manager | wappalyzer | 15.4% |
| MySQL | wappalyzer | 15.14% |
| cdnjs | wappalyzer | 13.57% |
How ScanMalware detects Cloudflare
Cloudflare is detected by analysing the response headers, HTML markup, JavaScript runtime and asset URLs captured when ScanMalware loads the site in a real headless browser.
From any scan you can pivot into related signals — JARM TLS fingerprints, ASN ownership and BGP routing, certificate history, JavaScript analysis and the overall security verdict — to understand not just that Cloudflare is present, but how it is being used. Open the full search interface for Cloudflare →
Recent public scans featuring Cloudflare
A rolling sample of recent public scans where Cloudflare was detected. Listing a site here is not a safety judgement — open a scan to see its full verdict.
| Site | Scanned |
|---|---|
| Premium Marketplace for Legacy 2021/22 Digital Identities. Specialized infrastructure for EV, En https://www.domainxnames.com/ | 2026-08-03 |
| Suspected Malware | Cloudflare https://sp0ct-xorqax-biz-zelvok-garnem.pages.dev/ | 2026-08-03 |
| Suspected Malware | Cloudflare http://sp0ct-xorqax-biz-zelvok-garnem.pages.dev/ | 2026-08-03 |
| Suspected Phishing | Cloudflare https://sp0ct-zelvax-biz-corqor-jarnem.pages.dev/ | 2026-08-03 |
| Suspected Phishing | Cloudflare http://sp0ct-zelvax-biz-corqor-jarnem.pages.dev/ | 2026-08-03 |
| Suspected Malware | Cloudflare https://sp0ct-zorvok-biz-correm-jenqax.pages.dev/ | 2026-08-03 |
| Suspected Malware | Cloudflare http://sp0ct-zorvok-biz-correm-jenqax.pages.dev/ | 2026-08-03 |
| Suspected Malware | Cloudflare https://std-y91-jxoq-oq16v4-xskwfp.pages.dev/ | 2026-08-03 |
Frequently asked questions about Cloudflare
- Does using Cloudflare mean a website is unsafe?
- No. Cloudflare is a stack component, not a verdict. ScanMalware scores the whole page — its scripts, redirects, certificates, threat-intelligence matches and behaviour — so a site using Cloudflare can be perfectly safe or actively malicious.
- How many sites using Cloudflare has ScanMalware scanned?
- Cloudflare has been detected in 102,902 public scans on ScanMalware.com. Each scan is a real headless-browser visit, and the figure updates as new URLs are submitted.
- What technologies are commonly used with Cloudflare?
- Across scanned sites, Cloudflare is most often seen alongside Cloudflare Bot Management, HTTP/3 and X-UA-Compatible. The full co-occurrence breakdown is listed on this page.
Browse all profiled technologies on the technology index, or scan a URL to see its full stack.