A broad edge block can stop the campaign and also catch legitimate application routes.
Threat disruption demands speed, while customer continuity demands evidence strong enough to justify an irreversible enforcement boundary.
Who you’d be doing this for
“Our login route got pulled into the review list, and my product lead wants to know if users will get blocked.”
Sofia Blanco · Platform Security Engineer
Maintains a legitimate Workers-based authentication service whose request patterns resemble some campaign traffic.
What is at stake
Thirty-one confirmed domains point to an active phishing campaign, but 146 related routes have incomplete attribution. You have to weigh rapid disruption against a false-block boundary that customers cannot easily escape.
Why it isn’t already fixed
Every obvious fix costs something else. That’s the part you’d have to decide.
- campaign disruption vs. legitimate traffic continuity
- automated correlation vs. verified enforcement
- irreversible action vs. adversary speed
- legal defensibility vs. containment breadth
Why Cloudflare
Workers can execute customer code across the same global edge network used to disrupt phishing and abuse infrastructure.
Written with these in mind
Not your kind of problem? 51 more at Cloudflare, or browse every organization.
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.