A Legit Cloudflare Product That Looks Exactly Like a Phishing Scam

Security researcher Eric Lawrence walks through his attempt to claim a handle for a new Cloudflare product and finds every warning sign of a consent-phishing attack — despite the offering being entirely legitimate. The entry point lived on a cheap, unvetted .pay domain with no technical tie to cloudflare.com, an OAuth-style authorization screen that didn’t recognize its own company’s feature, an over-broad permission request, and a green ‘verified’ checkmark that turned out to be a poorly placed UI element meant to be hovered over rather than trusted at a glance. The urgency of racing to grab a desired username only amplified the pressure that real attackers exploit.

When he tried to do the right thing, the safeguards failed too. There was no in-context way to report a suspicious request, Cloudflare’s own AI support agent first flagged the site as an attack (and initially asked for full account control instead of read-only), and the official HackerOne reporting path was blocked by a broken CAPTCHA. The episode illustrates why URL-reputation services like SmartScreen and SafeBrowsing struggle to separate malicious sites from legitimate ones when trusted brands themselves adopt phishy patterns.

Lawrence’s takeaways are aimed at developers: keep products under a trusted domain, surface security context where users actually make decisions, make abuse reporting trivial and in-context, and test that those reporting flows actually work. His closing note to fellow security folks — don’t blame users, because spotting this stuff is a nearly impossible job.