The reports are word for word identical. They describe an "order" and product pages that have never existed on my site (they return 404). The file hash in the report doesn't match the hash in its own VirusTotal link, which returns "Item not found". Only the date changes, and twice it's been misspelled ("October 52026", "Octoboer 8 2026"). Cloudflare's team has cleared four of them. The reporter pastes the same text again within a day.
The result is that my homepage has been blocked for most of two weeks, my traffic has halved, and Google is indexing the warning page instead of my site. I've opened support cases and requested reviews each time. I've had one reply, on 5 October, and nothing on a lasting fix.
I'm not asking for special treatment. I'd like to know: 1. Is there a way to stop automatic mitigations from a reporter or text that has already been shown to be false? 2. Is there a manual-review setting for a domain? 3. Has anyone else seen the abuse form used like this, and how did it end?
The same problem is described in my open case with Cloudflare (#02370521). Thanks for any pointers, and if anyone from Cloudflare's abuse team reads this, I'd welcome a reply.
Step 2: Give DoS attackers a "report" button they can use to deny service to websites, and provide a hosting service for the DoS attackers
Step 3: ????
Step 4: Profit!
I mean how hard would it be for a regional CDN to run a resource get request on the server and confirm the reported page is as described in the report themselves, that could be done in a completely automated fashion (without any AI, or attention needed, and in the case of false abuse reports pinning decisions [which depend quite a bit on the legislative region]).
Sorry you are having to deal with this.
There are sometimes instances where fake abuse reports aren't actually fake but by all appearances they appeared fake from the perspective of the person asking for help. This doesn't sound like the case here, but I thought I'd mention it since thanks in large part to the the large adoption of CDNs; its quite possible to have different pages displayed in different regions if one hasn't pre-emptively locked that down in a number of ways.
There are configuration and security mitigations that can help quash that when bad actors are exploiting this, but it doesn't sound like this is the case given what you described.