Hiding your C&C behind clownflare is basically the default mode for a lot of actors.

CF are terribly slow to respond to abuse, their ranges are allowlisted everywhere, and it’s not terribly hard to hide your backend infrastructure (origin) even from cloudflare itself.

Sure you have to deal with the eventual takedown of your domain, by CF or more likely the domain registrar, but it’s trivial to work around that (backup domains, frequently rotating them, etc).

What’s funny is how Namecheap are now absolutely god tier at doing takedowns on malicious domains - they used to have a very poor reputation and now will process a takedown (provided evidence) within the hour usually.