Target or banks or law enforcement can ask CloudFlare to take action (or perhaps explicitly not take action), depending on what's appropriate. Third party vigil

Target or banks or law enforcement can ask CloudFlare to take action (or perhaps explicitly not take action), depending on what's appropriate. Third party vigilantes and 'social pressure' that can't be calibrated to the wishes of real victims and responsible authorities should not. The cards are out there; having a sketchy resale site routing its traffic, and paying, CloudFlare may be better for maximum long-term justice than forcing such a site to their next-best options. And given how often law enforcement itself has run 'carding' forums, for the purpose of eventually rolling them up, who knows what's really going on? The same Krebs post also mentions a major bank bought card info from the site, to learn what was out there. Shame that bank into stopping that practice, too? Or trust that the bank knows what's in its long-term interest, since it faces more risk and has more professional staff aimed at this problem?