The author recounts a near-miss with what appeared to be a phishing attack originating from Cloudflare. While trying to claim a preferred handle, they encountered a permission request on `cloudflare.pay`, a domain not associated with Cloudflare's main site. This, combined with a suspicious green checkmark and the urgency of claiming the handle, mimicked common phishing tactics.

Despite initial suspicion, further investigation revealed the request was legitimate, part of a new Cloudflare Wallet feature. The author highlights how legitimate services can inadvertently create user confusion by not adhering to security best practices, such as hosting new features under trusted domains and providing clear reporting mechanisms for suspicious activity. The incident underscores the difficulty faced by URL reputation services in distinguishing malicious sites from legitimate ones, especially with the constant influx of new web domains.

The author implores web developers to host applications under trusted domains, link new domains directly, display security information clearly, and make reporting scams easy. For users, the advice is to think before clicking and to wait if unsure. The piece concludes by emphasizing that the burden of security should not solely rest on users when systems are designed in a way that makes security decisions unnecessarily complex.