Is cloudflare.bz safe?

A Cloudflare-branded verification screen on a domain that is not Cloudflare

The rendered page carries the Cloudflare logo and prints "cloudflare.com" as its heading, with the line "Verify you are human by completing the action below." A Turnstile-style box shows a spinner reading "Verifying..." with small "Confidentiality" and "Terms and conditions" links, and the footer adds "Ray ID: 56a4c5299fdetmca" plus "Platform performance and security Cloudflare". Every one of those elements is copied from a genuine Cloudflare challenge page.

The domain itself is cloudflare.bz, not cloudflare.com. It was registered on 11 October 2026 through GNAME.COM PTE. LTD. with the registrant's personal details hidden, and it is 24 days old at the time of analysis. A real Cloudflare challenge is served from Cloudflare's own infrastructure; a standalone domain borrowing the brand and the challenge layout has no legitimate reason to exist.

Nothing else is on the page. No product, price, checkout, contact details, policy links or operator name appear anywhere in the rendered view, so there is no business, service or disclosure behind the verification screen.

The same screen is documented as a malware lure

Reporting describes criminals using a fake Cloudflare verification screen to trick visitors into installing malware. A national cyber-security agency documents the ClickFix technique, in which compromised sites show fake CAPTCHA or Cloudflare Turnstile pages that instruct the visitor to run commands on their own machine. The page here matches that template element for element.

Saved antivirus results record seven adverse engine verdicts against this domain, including phishing labels and a malware label, alongside malicious and suspicious ratings. That saved analysis is older than the current registration, so it should be re-confirmed rather than treated as a fresh scan, but it points the same direction as the visual evidence.

A scanner listing also classifies the site as a young site with hidden ownership, records the registrant country as Russia, and names related domains gfisoda.biz and latoem.biz. Those related domains are reported by that source, not verified here.

Clean connection checks do not make the page trustworthy

The connection is properly encrypted with a valid certificate, the redirect from HTTP to HTTPS stays on the same domain, and the browser threat feed returned no warning for the URL. The hosting IP also has no abuse reports. These facts mean the transport is not the problem and no blocklist currently flags the address; they say nothing about who runs the page or what it does after the spinner.

The operator side is the problem. Ownership is hidden, the domain is three weeks old, no operator is named anywhere on the page, and the only content is a security-vendor imitation. The browser probe of the verification widget produced no navigation, popup, download or notification request, so the payload stage was not observed — that is the one part of the chain left unconfirmed.