Skip to main content
Recon
Add Recon to Shopify
Menu
Incident ResponseUpdated

How to report a fake store to Cloudflare

Cloudflare often sits in front of a fake store but does not host it. When a Cloudflare abuse report helps, which type to pick, and a copy-paste report.

Many fake stores use Cloudflare. Most of the time Cloudflare is not the host. It sits in front of the real server and passes traffic through. Cloudflare says it “cannot remove content from the Internet that we do not host”. What it does is pass your report to the people who can.

Checked against Cloudflare’s public trust and developer pages on October 14, 2026. This is not legal advice. Cloudflare can change its process, so check the linked pages before you report.

When should you report a fake store to Cloudflare?

Report to Cloudflare only when the clone’s traffic actually goes through Cloudflare. Cloudflare nameservers alone do not prove this. A site can use Cloudflare for DNS and still point straight at another host.

To check:

  1. Look up the clone’s IP address with any DNS lookup tool.
  2. Look up who owns that IP address, for example with ARIN search or another regional registry.
  3. If the owner is Cloudflare, the site is proxied through Cloudflare. Report it to Cloudflare.
  4. If the owner is another company, that company is the host. Report the clone to it directly.

Cloudflare’s form covers these types: phishing, copyright (DMCA), trademark, malware, and child exploitation material. For a fake store:

  • Phishing fits a clone that pretends to be you to collect card or login details.
  • DMCA fits your copied photos and text.
  • Trademark fits use of your registered mark. Cloudflare says it “only acknowledges abuse reports from trademark holders or their legally authorized representatives.”

How do you report a fake store to Cloudflare?

  1. Save the evidence first. Take dated, full-page screenshots of the clone’s pages. Do not enter real card details.
  2. Confirm the site is proxied, as above.
  3. Open abuse.cloudflare.com and choose the report type.
  4. Give exact addresses. Cloudflare asks for the most specific address of each item. For phishing it needs “The domain in question” and “The specific link to the phishing page.”
  5. Paste the report below into the description.
  6. Use business contact details. Cloudflare forwards complaints to the host and the site operator, so use a business address and email.
  7. Log the report with the date and any reference number.

What evidence does Cloudflare ask for?

  • The clone domain
  • The specific link to each phishing or copied page
  • For DMCA: your original work, the copied work, your contact details, a good-faith statement, an accuracy statement under penalty of perjury, and your signature
  • For trademark: proof you hold the mark or act for the holder
  • Dated screenshots, with the time zone

Copy-paste report for Cloudflare

Use this for a phishing report. Only include statements that are true for your case.

Fake store impersonating [Your Brand] (phishing)

Domain: [clone-domain.com]
Phishing pages:
- https://[clone-domain.com]/
- https://[clone-domain.com]/checkout

This site pretends to be our store, [Your Brand]
(https://[your-store.com]). It uses our name, logo, product photos and
descriptions. It asks visitors for payment card details at checkout.
It is not connected to us.

Screenshots taken [date, time, time zone] show the clone next to our
real pages.

Please forward this report to the hosting provider and to the site
operator.

[Your name], [Title], [Your Brand]
[Email] / [Phone]

For copied photos and text, file a separate DMCA report. The DMCA takedown generator writes the full notice.

What happens after you report to Cloudflare?

For sites it only passes traffic to, Cloudflare says it will:

  • “Forward your complaint to the website operator and the hosting provider”
  • “Provide the hosting provider with the origin IP address of the content at issue to help them locate it”

For copyright complaints, Cloudflare says it will “give rightsholders the hosting providers’ contact information”. You can then send your notice to the host directly.

For content Cloudflare hosts itself, such as Cloudflare Pages or Workers, it says “we will remove or disable access to that content” through its DMCA process.

If Cloudflare is the registrar of the domain, it says it “takes action to mitigate technical abuse like phishing by domains using our registrar services.” For a trademark dispute over the domain name itself, Cloudflare points to the domain owner and the UDRP.

  • Timing: not stated by Cloudflare for reporters.

What if the clone is not on Cloudflare?

Report to the real host and the registrar instead. A Cloudflare report cannot reach a site whose traffic does not go through Cloudflare. Look up the IP owner, then use that host’s abuse process.

Other reports to send

Let Recon prepare the reports

Recon is a Shopify app that watches for clones of your store. On every plan, it finds who to report each clone to and writes the notices for you to review and send. Early access on Pro: one click, and Recon files the reports for you. Cloudflare, the host or the registrar still decides what happens to a site. Recon never removes sites itself.

Add Recon to Shopify, or run a free website check first.

Sources

Keep reading

Reporting Brand Abuse Against a Shopify Store

How to document a copied store, match the evidence to the right reporting channel, and communicate clearly with affected customers.

Responding to a Suspected Compromised Domain

A practical incident-response sequence for unexpected DNS changes, registrar access loss, and suspicious redirects on a Shopify domain.

Phishing Takedowns for Shopify Stores

How to preserve evidence, identify the relevant provider, and report an observed phishing page without promising a takedown timeline.

Explore Recon’s Shopify brand protection tools

All knowledge