&gt; If my ISP controls one of the domains in this list, could it have carried out a successful attack without Cloudflare&#x27;s help?<p>No they cannot.<p>CloudFlare hold the private keys to those certificates. Did you visit the iFrame source directly? Doesn&#x27;t really see like much tbh.