Eric Law, a long-time Cloudflare user, encountered what he initially believed was a sophisticated phishing attack while attempting to claim a handle on Cloudflare’s new Wallet product. The experience illustrates how difficult it has become to distinguish legitimate services from malicious ones.
Law discovered the Wallet feature through a tweet and was prompted to sign in to his existing Cloudflare account. The authorization page displayed several characteristics that resembled consent phishing attacks—fraudulent requests designed to trick users into granting access to their accounts.
According to the source, several design choices raised red flags. The entry point was hosted on cloudflare.pay rather than cloudflare.com, despite Cloudflare’s main domain already containing his credentials. Law noted that .pay domains, available under the top-level domain sTLD, can be registered by anyone for $20, unlike more restricted domains such as .bank. This meant an attacker could theoretically register a similarly named domain to conduct phishing campaigns.
Additionally, the permission page displayed a green checkmark that appeared suspicious and could easily be mimicked by attackers. The page also lacked a “Report suspicious request” link that would allow users to alert Cloudflare to potential attacks.
Unable to find the Wallet feature in his Cloudflare dashboard or in official documentation, Law consulted an AI agent, which initially suggested the request was indeed an attack. He attempted to report the suspected phishing, only to later discover that Cloudflare’s Wallet is a genuine, legitimate product.
The green checkmark, upon closer inspection, was a legitimate security UI element that required hovering to display security details—a poorly executed design choice that undermined user trust.
Law’s experience highlights a broader challenge for web security. URL reputation services like Microsoft SmartScreen and Google SafeBrowsing must balance blocking malicious sites while avoiding false positives, as millions of new websites are added to the web weekly. When legitimate websites employ security practices that resemble phishing tactics, distinguishing genuine services from scams becomes significantly more difficult for both users and automated security tools.
Law concludes with recommendations for web developers to follow best practices: hosting content on trusted domain names, displaying relevant security information transparently, making scam reporting trivial and contextual, and testing security reporting flows to ensure they function correctly. He emphasizes that security responsibility should not fall solely on users who face an “impossible job” in staying safe online.
Key facts
- A Cloudflare security researcher initially mistook the company’s legitimate Wallet feature for a phishing attack
- The Wallet product was hosted on cloudflare.pay rather than cloudflare.com, raising security concerns
- The authorization page lacked a “Report suspicious request” feature that could alert users to potential attacks
- A green checkmark security indicator was poorly placed and required hovering to display security details
- The incident highlights challenges URL reputation services face in distinguishing legitimate sites from scams