If that illegal behavior does not seem to be likely to harm either the room or other guests, I feel like the people who are saying that not only "the correct thing" for a hotel to do here but "what I expect most hotels to actually do in this situation" is to, if they do anything, at most alert local law enforcement and cooperate with them if there is an issue, not decide to send hotel employees to go run an internal investigation to verify the activity even is illegal in the first place, after which point I guess the idea is you want to send the bell hop and the concierge and the night security officer to go evict them from the hotel?... This just isn't how anything is done and is asking the wrong things of the wrong people leading to situations that are super dangerous for everyone involved.

Meanwhile, it isn't even "in the public's best interest" for the hotel to act as law enforcement as the most they can do is evict the person from their one hotel, not actually stop them from doing whatever "illegal behavior" is taking place. (At this point, apologists for monopolies probably start arguing that this is why we are all better off if everyone is forced to use one or two providers, so that everyone can be forced to fall in line with whatever the new corporate vigilante justice rules are... sigh.) Law enforcement is empowered, trained, and equipped to actually do something, not the hotel staff.

>if they do anything, at most alert local law enforcement and cooperate with them

And cloudflare isn't even doing that. They just shrugged and decided they would continue to collect profit off the criminal behavior and act as a brick wall for OP in this case. They don't have to be the law enforcement here, but they should be obligated to report this activity to law enforcement and let law enforcement do their jobs. OP will probably have to get a lawyer and spend a lot of money and time to force cloudflares hand to turn in the phisher, all while their business is being hurt directly, and that's just not right at all.

Their responsibility is to report illegal behaviour to the proper authorities, not to confront them or kick them out.

edit: spelling

And they aren't doing that in OPs case. Just continuing to profit off the phisher and shrugging their shoulders.