The phishing cluster must move before the adversary rotates, but its boundary is not fully proven.
Customer protection favors rapid distribution while legitimate-domain safety requires evidence that the inferred links can bear.
Who you’d be doing this for
“My phishing queue doubled before lunch, and leadership wants to know what we blocked.”
Gang Ito · Security Operations Lead
Runs incident response for a security service customer whose controls consume threat intelligence indicators.
What is at stake
The cluster contains seven times more related domains than yesterday, but some links are inferred. You have to weigh campaign disruption against the cost of blocking a legitimate customer destination.
Why it isn’t already fixed
Every obvious fix costs something else. That’s the part you’d have to decide.
- campaign disruption vs legitimate traffic integrity
- six-hour response window vs evidence verification
- automated reach vs legal defensibility
- cluster coverage vs false-block exposure
Why Cloudflare
Cloudflare network signals and IOC integrations place the phishing-domain decision directly between global disruption speed and customer traffic integrity.
Written with these in mind
Not your kind of problem? 51 more at Cloudflare, or browse every organization.
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.