Cloudflare does take reports seriously when a site exists to phish logins from another site’s users (whether that site is a clone, or just claims to be representing the other party when it isn’t.) Especially when that other site has a credit card form.

Sadly, the most they can really do (about their regular Cloudflare Proxy clients, at least) is reveal to you the unmasked hosting info of the origin site; at which point you’ve got to start another process for reporting a TOS violation to the origin’s hosting provider.