Cloudflare publicly emphasizes that it “does not host content” on its pass-through CDN and forwards all complaints to origin hosts, but critics say this lets criminals slip through the cracks. For example, Cloudflare’s own transparency reports document DMCA and legal takedowns, but say nothing about how often it blocks abusive content. This article will expose concrete cases of unchecked abuse, highlight expert analyses of Cloudflare’s opaque policies, and explain why these gaps should concern policymakers and cybersecurity researchers under new rules like NIS2 and the EU’s Digital Services Act.
Criminals Living on Cloudflare’s Infrastructure
Cybercriminals routinely exploit Cloudflare’s services to cloak malicious sites. Spamhaus reports that 10.05% of all domains on its Domain Blocklist are hosted on Cloudflare’s servers, far above normal. In practice, attackers often flip already-malicious domains to Cloudflare nameservers to hide the origin IP. As Spamhaus explains, Cloudflare “effectively masks the true location of the backend” and simply passes on abuse reports to whoever controls the site.
This means that reports of phishing or malware end up in the abuser’s inbox, or with an uncaring hosting provider. In consequence, many active phishing campaigns and malware sites remain live. Even when abuse is obvious, Cloudflare’s forms tend to auto-reject or defer complaints. For instance, cybersecurity researchers at Excedo Networks notes that abuse submissions to Cloudflare often get only canned “unable to confirm” replies, letting fraud pages linger. In short, Cloudflare’s massive CDN and DNS network have become a “bulletproof hosting” service for criminals – an implicit shield that hides their infrastructure from defenders.
A “Content-Neutral” Cover
Cloudflare insists that it only provides neutral infrastructure and cannot remove content it does not host. By this logic, it forwards abuse complaints to website operators and hosting providers instead of taking direct action. In practice, however, critics say this policy is self-serving. Spamhaus bluntly calls it “problematic” – pointing out that by refusing to police content, Cloudflare is effectively facilitating a bulletproof hosting environment where only Cloudflare’s own IPs are visible.
The spam watchdog notes that this approach is cheap for Cloudflare (“cost of dealing with abuse is very low”) but it “weakens trust and safety” on the Internet. In effect, Cloudflare’s scale lets it dodge responsibility: abuse happens “off-site,” so Cloudflare does not intervene unless legally forced or under extreme public pressure. Only in rare, high-profile cases (e.g. extremist forums) has Cloudflare eventually terminated service, and even that only after withering criticism.
Opaque Transparency, Hidden Actions
Cloudflare does publish semi-annual transparency reports, but they reveal almost nothing about its abuse outcomes. As Lawfare analysts note, Cloudflare’s reports focus solely on legal removal requests (like DMCA notices) and omit any data on content moderation. For example, there is no record of how many phishing sites were taken down or how many harassment or extremist reports led to action.
In fact, “there’s no way of knowing how Cloudflare’s policy is applied,” the Lawfare piece explains. Except for a handful of famous takedowns (Daily Stormer, 8chan, Kiwi Farms), “the how, the why, and the who” of Cloudflare’s content moderation decisions remain completely opaque. Meanwhile Cloudflare emphasizes that most of its services are “pass-through” intermediaries, subject to minimal transparency rules under the EU Digital Services Act.
In other words, as an infrastructure provider it faces few obligations to report on abuse handling, creating a regulatory blind spot. Security experts warn this gap could conflict with new laws: for instance, a recent analysis argues Cloudflare’s “lack of transparency” and potential harbouring of bad actors may put public agencies on a collision course with the EU’s NIS2 cybersecurity rules.
Regulatory Implications and Next Steps
Cloudflare’s model raises urgent questions for lawmakers and researchers. Under NIS2 and the DSA, major Internet services must manage risk and promptly act on illegal content. Yet Cloudflare’s US-centric, content-neutral approach lets it sidestep most takedown duties. As one EU brief observes, Cloudflare’s huge reach and business model sometimes outweigh initiative-taking security measures.
Policymakers may therefore need to rethink where responsibility lies: should CDNs and DNS providers be treated more like publishers or hosts when they knowingly protect criminal sites? At minimum, experts argue Cloudflare should be required to publish detailed metrics on abuse reports and actions, and to cooperate better with law enforcement. Without such accountability, “abuse does not just happen – it is enabled.”
Conclusion
Cloudflare wields enormous power over Internet traffic, but its current abuse-handling leaves it unaccountable. For the public interest, decision-makers and security researchers must push for greater transparency and oversight. Only then can we ensure that Cloudflare’s vital infrastructure role is not undermined by a policy of ignoring clear threats.
