How Cloudflare is using automation to tackle phishing head on
Mar 17, 2025Javier Castro, Justin Paine, Rachael Truong
Summary
This post details the development and deployment of an automated phishing identification pipeline on the Cloudflare Developer Platform. The pipeline leverages Cloudflare Workers for initial URL scanning, Workers AI for machine learning classifiers, KV and Durable Objects for storing report summaries and tracking attributes, Hyperdrive for accessing Postgres abuse report data, Queues for managing scanning jobs, and D1 for storing detection logs. A Remix Pages UI is used for presenting analysis to investigators. The automation significantly improved the resolution rate of phishing reports from 37% to 78% and reduced the median time to action from 3.4 days to under an hour.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack