Abusing DNS record management controls, the threat actor hides the location of malicious content via Cloudflare.