Same Story as it ever was. The first time I encountered what I thought was a phishing attack at the bank I worked at 25 years ago, it turned out to be a marketing campaign, with URLs that put our company name as a user before the domain name (back in the day when creds could go in the URL).
replyFun fact: still can in Chromium-based browsers.
https://textslashplain.com/2023/03/22/attack-techniques-spoo...
replyIt's probably easier for the marketing department to get a new domain up and running that it is for a new subdomain within their own company. Battling Business Units and all that.
replyThat's a problem that should be solved then, because literally everyone loses when it's done this way
replyYou really would think that at least in theory a company like Cloudflare would make it very easy for internal teams to automatically request new subdomains
replyRunning marketing off a separate domain is often a conscious decision because if they start getting blocked for spam, then critical service/operational emails from your actual domain might also get blocked.
replyOh good, I'm glad that Cloudflare, proud defender of internet security, is properly focused on the important goal of optimizing for their ability to send promotional emails to my inbox rather than silly things like helping prevent phishing attacks.
replythis is the correct take
reply