Cloudflare Automates Phishing Reports, Cutting Median Response Time to Under an Hour

Cloudflare says new automation sharply sped up how it handles reports of phishing sites. In the second half of 2024, its systems resolved 78% of phishing reports automatically, and the median time to act on reports about hosted sites fell to under an hour. In the first half of that year, automation handled 37% of reports, while the median response time was 3.4 days.

The change addresses a growing workload and more varied forms of deception. Phishing can arrive through conventional email, QR codes designed to evade detection, or “monster in the middle” attacks that target two-factor authentication. Attackers also use AI to produce personalized messages at scale. Cloudflare says it has observed phishing activity rise through 2023 and 2024, in line with broader industry reporting.

From individual reviews to automated triage

Cloudflare receives abuse reports from people who suspect that a website using its services is involved in harmful activity. Trust & Safety investigators previously reviewed each complaint by examining the reporter’s allegations and the site’s content, then deciding whether it appeared to involve phishing or malware. As the company’s customer base and the volume of reports grew, that manual process became difficult to sustain.

Cloudflare’s response was to combine several sources of evidence: network observations, information from its Email Security product, trusted external threat feeds, and patterns learned from years of processing abuse reports. The aim is to estimate whether a reported URL is likely to be phishing, then recommend a response based on how investigators have handled comparable cases.

That distinction matters. A report is an input to the system, not proof that a site is malicious. Reports can be mistaken or deliberately aimed at legitimate sites, and acting on a false positive can disrupt customers and undermine trust. Cloudflare says its rules account for that risk by including ways to reject erroneous reports.

How the detection pipeline works

Cloudflare built the identification system on its Developer Platform, using a Worker to process submitted URLs. Each URL first goes through the Cloudflare URL Scanner, which gathers rendered HTML, network requests, and other site attributes. This gives the system a snapshot of what the page presents and how it behaves during scanning.

The pipeline then enriches that snapshot. Cloudflare submits the HTML and page resources to in-house machine learning classifiers to assess reputation. Indicators of compromise are checked against threat feeds and domain categorization tools, which can surface known malicious infrastructure or prior classifications. A rules and heuristics layer combines those findings to label the URL and suggest decisions about the report and any harmful content.

The rules draw on investigator practice and observed patterns of abusive behavior. This lets the automated workflow take on decisions that once required a person to assess every complaint. Cases the system cannot confidently resolve can still be presented to investigators for further review.

Several Cloudflare services support the workflow. KV stores summaries of reports; Durable Objects maintain counters for attributes the team tracks over time. Hyperdrive connects the system to the internal Postgres database that holds abuse reports, while Queues manage scanning jobs. Workers AI runs the classifiers, and D1 stores detection logs for later evaluation. A Remix Pages interface gives Trust & Safety investigators access to the system’s analysis, including results that need follow-up.

Cloudflare says this platform let the team expand or remove data enrichments with relatively little effort, while handling scanning demand. The source doesn’t give details such as the number of URLs processed, classifier accuracy, or the share of cases sent to human review. Those measures would help readers assess how the reported response gains vary with workload and how often automation reaches a confident decision.

Report data can inform customer products

Cloudflare also uses patterns found in abuse reports to improve its security products. Examples include recurring phrases in phishing attempts, infrastructure reused across malicious sites, and activity coordinated across multiple domains. The company says these signals can support application security, email security, threat intelligence, and brand protection.

Brand Protection customers can report suspected abuse from the Cloudflare dashboard. Cloudflare says those submissions can help its Trust & Safety team identify related threats across its network, including threats affecting customers who don’t use Brand Protection. The company also says discussions with customers and outside experts help it develop more targeted detection rules for emerging patterns.

Customers can report suspected phishing through Cloudflare’s abuse reporting form or, for programmatic submissions, the abuse reporting API. Enterprise customers can ask about Brand Protection. Existing users can update their brand assets to help distinguish legitimate sites and logos from imitations, and all customers can keep their abuse contact current in the dashboard.

The reported results show a substantial shift in Cloudflare’s handling of hosted phishing reports, with a median response time below an hour in late 2024. The next useful measure will be how the system performs as attack methods change: speed matters, but so do accurate decisions, manageable review queues, and protection against reports aimed at legitimate sites.