> they already remove sites that are hosting phishing attacks and malware.

If only...

Let me quote [0]:

> CloudFlare will forward all abuse reports that appear to be legitimate to the > responsible hosting provider and to the website owner. In response to a legitimate > abuse report CloudFlare will provide the complainant with the contact information for > the responsible hosting provider so they can be contacted directly.

So, if I report a scammer CloudFlare will forward my information to that criminal, putting me at risk. Gee, thanks!

and

> Since CloudFlare is not a hosting provider we do not have > the capability to remove content from a website.

Or to put it in the words that they answer every abuse request with:

> Please be aware CloudFlare is a network provider offering a reverse proxy, > pass-through security service. We are not a hosting provider.

Which basically translates to "We don't care, we want to pretend that we are not responsible for our actions."

[0] https://www.cloudflare.com/abuse/