# Even Cloudflare Couldn't Tell Cloudflare From Phishing > Source: > Published: 2026-08-04 20:10:56+00:00 [Security](https://sourcefeed.dev/c/security)Article # Even Cloudflare Couldn't Tell Cloudflare From Phishing A veteran browser-security engineer ran phishing triage on the Wallets launch, and Cloudflare's own support AI agreed with him. [Ji-ho Choi](https://sourcefeed.dev/u/jiho_choi) On August 4, Cloudflare [launched Wallets](https://blog.cloudflare.com/wallets/) — stablecoin accounts and stable identities so AI agents can pay for APIs and content on their own — and opened handle reservations at `cloudflare.pay` . Within hours, Eric Lawrence had concluded it was a scam. Lawrence isn't a guy who falls for scams. He built [Fiddler](https://www.telerik.com/fiddler), spent two years on the Chrome security team pushing HTTPS across the web, and now works on SmartScreen and phishing defense at Microsoft. He ran the triage checklist that people like him wrote: unfamiliar domain, an OAuth-style consent screen, a security badge he couldn't parse, no trace of the product in Cloudflare's dashboard or docs. Verdict, [in his words](https://textslashplain.com/2026/08/04/security-is-hard-yall/): "This looks exactly like one of those Consent Phishing attacks that have been so popular over the last few years!" Then it got better. He asked Cloudflare's AI support agent — which opened the conversation by requesting *full control* of his account, before he knocked it down to read-only — and Cloudflare's own bot told him it really was an attack. It took frantic searching and a stranger on X to establish that the product was real, the domain was official, and the suspicious green checkmark was genuine security UI he was supposed to hover over. Every signal in the checklist fired correctly. The checklist just can't distinguish a phishing campaign from a modern product launch, because they're built from the same parts. ## The launch was assembled from a phishing kit Look at the components. A vanity domain nobody has seen before: `.pay` is Amazon's registry, currently in a limited registration phase where the eligibility bar is roughly "you take payments online through an approved processor" — a hurdle any Stripe customer clears — with general availability slated for late 2027. Lawrence's "available to anyone with $20" is slightly ahead of schedule, but the substance holds: unlike `.bank` , where the registry verifies you're actually a chartered financial institution, `.pay` vetting is a speed bump. A scarcity mechanic: reserve your handle now, before someone takes it — urgency being the single most reliable ingredient in social engineering. A consent screen requesting account access for a feature that doesn't appear anywhere on the site you actually trust. That's not a launch that resembles phishing. That's phishing's exact bill of materials, shipped by the legitimate party first. This is the structural problem, and it's why the Hacker News thread filled up with people admitting they'd also assumed the launch was fake. For twenty-five years we've told users the URL is the ground truth. Then legitimate companies trained them out of it: login flows that bounce through `microsoftonline.com` and `live.com` , banks sending campaigns from ESP tracking domains, every marketing team buying a fresh `.io` because the real domain "didn't fit the brand." Each one is individually defensible. Collectively they're a commons problem — every off-origin launch burns a little more of the signal that phishing defense depends on, and the cost lands on users and on everyone else's abuse queue. Meanwhile the indicators we offered as compensation are all dead. Browsers pulled EV certificate badges from the address bar in 2019 because eye-tracking showed nobody looked at them. Chrome retired the padlock in 2023 because users read it as "this site is safe" rather than "this connection is encrypted." Lawrence himself coined the [line of death](https://textslashplain.com/2017/01/14/the-line-of-death/) — the boundary below which every pixel is attacker-controlled — and on launch day he couldn't tell which side of it Cloudflare's checkmark sat on. When the person who invented the mental model can't apply it, the model isn't teachable. His conclusion is the right one: "Never blame the victim — they've got an impossible job." ## Your support bot now works for the attackers The AI agent detail deserves more attention than it's gotten, because it's a genuinely new failure mode with a shelf life measured in every future launch. Support bots are grounded in indexed docs, and docs lag announcements. So on the one day when confused users flood in asking "is this real?", your bot — speaking with your brand's full authority — will confidently deny the product exists. A human support rep who hasn't heard of a feature says "let me check." A RAG pipeline says *no such product*, which any reasonable user reads as confirmation of fraud. The fix is boring and procedural: the support index gets updated before the tweet goes out, launch FAQs land in the bot's grounding the way status-page entries land before maintenance windows. Almost nobody's launch runbook includes this today. After this week it should. And while you're in there: an assistant that defaults to requesting full-control account scopes is teaching your users that over-broad consent screens are house style — which is precisely the reflex consent phishing exploits. The 2017 Google Docs worm and the wave of verified-publisher OAuth abuse against Microsoft 365 tenants worked because granting broad scopes to plausible-looking apps had been normalized. Read-only by default isn't a nicety; it's herd immunity. ## Wallets for agents, vibes for humans There's a sharp irony in which product tripped this wire. Cloudflare Wallets exists because agents can't do vibes-based trust: the whole design is cryptographic identity, spending caps, merchant allowlists, and maximum transaction sizes enforced at the protocol layer via x402. Machines are getting the verifiable trust infrastructure — signed identity instead of squinting at a checkmark — that humans were never given. An agent won't be fooled by `cloudflare.pay` ; it verifies a key or it doesn't transact. But the human on-ramp remains: someone has to fund the wallet, approve the scopes, claim the handle. That approval surface is exactly what attackers will clone, and agentic payments hands them a fresh template with real money behind it. Expect lookalike "reserve your agent's wallet" campaigns within weeks, and expect them to work, because Cloudflare just demonstrated that the legitimate version is indistinguishable from the attack — its own AI said so. If you ship anything with a login this year, treat launch UX as attack surface and put it through security review like any other endpoint. The checklist is short. New features live under your canonical origin (`pay.cloudflare.com` was right there); vanity domains 301 to it and never terminate a login flow. The product appears in the authenticated dashboard the moment marketing goes public, so there's a chain of custody from the origin users already trust. Consent screens default to minimal scopes and carry an in-context "report suspicious" link — which someone has actually tested. And your support bot knows about the launch before your followers do. None of this is expensive. It just requires someone with the authority to tell marketing that the memorable domain is a liability — and Cloudflare, a company that literally sells anti-phishing protection, evidently didn't have that person in the room. That's the real lesson: this isn't a Cloudflare-competence story. It's what happens by default when growth mechanics and security review report to different people. The web's trust signals aren't being destroyed by criminals. We're spending them ourselves, one launch at a time. ## Sources & further reading - [Web security is too hard](https://textslashplain.com/2026/08/04/security-is-hard-yall/)— textslashplain.com - [Announcing Cloudflare Wallets: The programmable wallet for the agentic Internet](https://blog.cloudflare.com/wallets/)— blog.cloudflare.com - [Cloudflare just launched a permanent ID tool and wallet for AI shopping](https://fortune.com/2026/08/04/cloudflare-ai-agents-wallets-id/)— fortune.com - [Sunrise for .PAY begins on April 13: Additional Restrictions Apply to Registrations After Sunrise](https://iptwins.com/2026/04/03/sunrise-for-pay-begins-on-april-13-additional-restrictions-apply-to-registrations-after-sunrise/)— iptwins.com - [Web security is too hard (Hacker News discussion)](https://news.ycombinator.com/item?id=49172834)— news.ycombinator.com [Ji-ho Choi](https://sourcefeed.dev/u/jiho_choi)· Security & Cloud Editor Ji-ho covers the increasingly tangled overlap between cloud architecture and security, drawing on a background as a penetration tester to keep his reporting grounded in real-world attack paths. He never lets a vendor claim go unquestioned and insists that every buzzword come with a proof of concept. ## Discussion 0 No comments yet Be the first to weigh in.