Cloudflare lookalike domains

What kind of lookalikes

Words most often added to the name in the last 90 days: app (7), verify (5), wallet (4).

Lookalikes per week

Endings

The 8 most used of the 23 top-level domains these lookalikes sit under.

Where they are registered

For the 209 with a registrar in WHOIS (86% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.

What the live ones do

19 of these lookalikes were registered and checked for a website and mail: 10 (53%) served a website and 6 (32%) publish MX records, so they can receive email. Checks run on the higher-severity matches that resolve, not on every lookalike.

Google Web Risk lists none of the 6 live ones checked against it.

6 were tracked while live and 0 have since gone down. See what to do about a lookalike.

Recent examples

The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Cloudflare; it is not necessarily malicious, and none of these is a claim about who registered it or why.

• cloudrflare[.]com
  Typo, Oct 14Not checked
• get-cloudflare[.]com
  Combo, Oct 14Not checked
• cloudflaro[.]com
  Typo, Oct 9Not checked
• cloudflareappstestc[.]com
  Combo, Oct 8Not checked
• cloudflareserviceworker[.]net
  Combo, Oct 8Not checked
• cloudflareappstesta[.]com
  Combo, Oct 6Not checked
• authcloudflare[.]to
  Combo, Oct 6No site or mail when checked
• cloudflade[.]com
  Typo, Oct 5Not checked
• cloudflareappstestb[.]com
  Combo, Oct 5Not checked
• cloudflareapps[.]org
  Combo, Oct 5Not checked

Further reading

• What combosquatting is, with examples
• Homoglyph and punycode domains, explained
• How to find lookalike domains of your own company
• What to do about a lookalike domain
• The weekly lookalike domain report, across all monitored brands