Phishing's hardest problem: volume and verisimilitude

Phishing remains one of the most publicized and devastating threat vectors, and defending against it is a constant battle. The core difficulty isn't just spotting a malicious email—it's distinguishing a convincing fake from a legitimate one at scale. Attackers exploit subtle misspellings (clodflare.com) or concatenate trusted names (cloudflare-okta.com) to create domains that fool even vigilant users. A single successful deception can lead to someone in your organization submitting administrator credentials to the wrong site, giving an attacker a direct path to exfiltrate sensitive data.

The challenge is compounded by the speed of modern attacks. During the July 2022 "Oktapus" campaign that breached more than one hundred companies, the attacker registered cloudflare-okta.com just 40 minutes before sending it to Cloudflare employees. In that case, the attack was thwarted, but the window for detection was narrow.

New phishing detection tools in Security Center

Cloudflare has opened beta access to new brand and anti-phishing tools within its Security Center dashboard. Designed for Cloudflare One customers, these features are built to catch and mitigate phishing campaigns earlier—potentially before they are ever sent. The system automatically identifies what are called "confusable" domains: common misspellings and concatenations of services that attackers register to trick victims into handing over passwords.

Historically, a delay existed between a domain's registration and its appearance on monitoring lists. By streaming newly observed domains resolved by the 1.1.1.1 resolver (and other resolvers), the new system can detect phishing domains almost immediately. This shrinks the window of opportunity for attackers significantly.

The tools live under the Security Center and give administrators controls such as custom strings to monitor and a searchable list of historical domains. Access, visibility, and automation levels depend on the Cloudflare One plan.

Real-time domain matching and alerts

The capability hinges on detecting hostnames created specifically for phishing. The system monitors the first use of a domain or subdomain by sifting through trillions of daily DNS queries to 1.1.1.1, compiling a list of hostnames appearing in the wild for the first time. It then applies fuzzy matching—comparing strings for similarity based on phonetics, distance, and substring matching—against saved patterns in real time. When a match is found, the system generates an alert.

While users currently need to create and save these queries, an automated matching system is planned. Custom strings for tracking more complex patterns will remain available.

Historical searches

Beyond real-time monitoring, the tools support historical searches for newly observed domains from the last 30 days. When a new pattern is created, search results from that window are displayed to quickly assess a domain's threat level. The same mechanism supports ad hoc domain hunting for investigating specific patterns or domains.

Most impersonated brands observed

To test the matching engine, Cloudflare examined how frequently domains containing phishing URLs were resolved against the 1.1.1.1 resolver. Shared hosting domains (like Google, Amazon, or GoDaddy) that could not be verified as phishing attempts were removed from the dataset. The resulting list of the top 50 most impersonated brands was compiled using one of the most common phishing domains per brand.

Notably, phishing sites are typically served on a specific URL path (e.g., hxxp://example.com/login.html) rather than at the root, so full URLs were not included in the reported data.

Enforcement through Zero Trust policies

The real value of these detection features is unlocked when paired with the Zero Trust product suite. As soon as a confusable domain is detected, security teams can create Cloudflare Gateway or DNS policy rules to block it. This prevents users from resolving or browsing to potentially malicious sites, stopping attacks before they escalate.

Planned enhancements

The new features are an opening move in a broader anti-phishing portfolio. Several enhancements are on the roadmap:

  • SSL/TLS certificate matching: The system will also match against new certificates logged to Nimbus, Cloudflare's Certificate Transparency log. Since certificates are typically created shortly after domain registration to lend HTTPS legitimacy, analyzing these logs can help identify fraudulent certificates used in phishing.
  • Automatic list population: Rather than scripting updates to custom lists, matching domains will be automatically added to dynamically updating lists that can be referenced in Zero Trust blocking rules, including for Gateway.
  • Metadata and ownership monitoring: Future capability will track changes in domain ownership, registrants, name servers, or resolved IP addresses, enabling customers to act on key information changes affecting their domains.

Enterprise customers can sign up for Beta access to gain private scanning for their domains, save queries, and configure alerts on matched domains.