Web security is too hard

A security researcher nearly fell for what appeared to be a phishing attack on Cloudflare's new Wallet feature, discovering that the legitimate product's authorization page exhibited multiple red flags including use of an unfamiliar .pay domain, a suspicious green checkmark, and a consent screen indistinguishable from known phishing tactics. The incident highlights how difficult web security has become for both users and detection services, as even legitimate websites increasingly adopt practices that resemble malicious phishing attacks, making it challenging for URL reputation services to distinguish real threats from false positives.