Let me play devil's advocate for a moment. Cloudflare does not host the website itself. If Cloudflare were to stop providing their services, the website might

Let me play devil's advocate for a moment. Cloudflare does not host the website itself. If Cloudflare were to stop providing their services, the website might be inundated with traffic, or more susceptible to DDoS attacks, etc., but even if they terminated their relationship, this would not prevent rescator.la from doing their damage. The Pirate Bay is an excellent example of how little power one actually wields simply by controlling the DNS level. Second, I'm a little concerned by the idea of a third party independently deciding that their client is guilty of a crime and unilaterally terminating that relationship. What if Krebs's analysis happened to be incorrect? What if someone had compromised rescator.la's servers and happened to be carrying out a false flag operation[0]? I use Cloudflare for a site I operate, and I would feel more than a bit uneasy if they terminated their relationship with a client in this manner. Maybe OP and Krebs are correct and rescator.la are completely guilty. But what's to stop them from making that decision (incorrectly) in the future? It's one thing to cooperate with law enforcement in an investigation[1], but it's quite another to appoint yourself the judge and make that ruling yourself. [0] Unlikely, but the point is that it's hard to be certain of what you think you know. [1] Which, as evidenced by the NSA debate, is not always so cut-and-dry either.