68% OF PHISHING WEBSITES ARE PROTECTED BY CLOUDFLARE

Summary from the TLDR InfoSec newsletter

Modern phishing operations increasingly rely on mainstream infrastructure like Cloudflare, major cloud providers, and popular developer-focused TLDs such as .dev and .app to appear legitimate and resist takedown. Attackers mix disposable direct-hosted servers with CDN-protected setups, often hiding behind services like Vercel, GitHub Pages, and other trusted platforms that organizations cannot simply block. Phishing-as-a-Service ecosystems now provide turnkey kits with MFA bypass, session cookie theft, and advanced evasion, heavily targeting brands like Meta, Amazon, and PayPal.