Hi guys!

A friend of mine recently got scammed on some mega sus website thats using cloudflare as their CDN and pretending to be another business. I found the website’s admin page… I wanted to try pentesting an actual website for a while now I just wanna try to bruteforce their admin panel and put some silly pictures or something to let people know that this is a scammer website. I have already reported the website to an anti scammer agency but I have one question from a legal perspective.

​

Can I get in trouble with Cloudflare/local authorities if they identify me? Im assuming attacking illegal websites would be ok but i dont want to get in trouble for doing something stupid

​

I know there are much smarter ways to go about this but I just see it as a fun little game that would test my skills. thanks in advance!