Return-Path: Delivered-To: employee@cloudflare.com Received: from mail-out.evil-domain.com (mail-out.evil-domain.com [192.0.2.100]) by mx.cloudflare.com with ESMTPS id abc123def456 for ; Mon, 15 Jul 2026 09:00:05 +0800 (SGT) Received: from localhost (localhost [127.0.0.1]) by mail-out.evil-domain.com (Postfix) with ESMTP id 789XYZ for ; Mon, 15 Jul 2026 09:00:01 +0800 (SGT) Received-SPF: fail (domain of cl0udflare.com does not designate 192.0.2.100 as permitted sender) client-ip=192.0.2.100; Authentication-Results: mx.cloudflare.com; dkim=fail (signature verification failed) header.d=cl0udflare.com header.s=selector1; spf=fail (sender IP is 192.0.2.100) smtp.mailfrom=it-support@cl0udflare.com; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=cl0udflare.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cl0udflare.com; s=selector1; h=from:to:subject:date:message-id; bh=2jUSOH9NhtVGCQWNr9BrIAPreKQjO6Sn7XIkfJVOzv8=; b=INVALIDBASE64SIGNATURETHATWILLFAILVERIFICATION== From: "Cloudflare IT Support" Reply-To: attacker@evil-domain.com To: employee@cloudflare.com Subject: [URGENT] Your account requires immediate verification Date: Mon, 15 Jul 2026 09:00:00 +0800 Message-ID: X-Mailer: PhishKit v2.1 X-Priority: 1 (Highest) X-Flag: CF{APAC_got_mail_i9j0} X-Original-Sender: definitely-not-suspicious@evil-domain.com X-Spam-Status: Yes, score=9.8 required=5.0 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0001_BOUNDARY" This is a multi-part message in MIME format. ------=_NextPart_000_0001_BOUNDARY Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Dear Cloudflare Employee, Your Cloudflare account has been flagged for suspicious activity. Our security systems have detected unusual login attempts from an unrecognized device. To prevent your account from being suspended, please verify your identity immediately by clicking the link below: https://cl0udflare-verify.com/login?user=employee&token=abc123 This verification must be completed within 24 hours or your account access will be restricted. If you did not request this verification, please ignore this email. However, we strongly recommend verifying your account to ensure its security. Best regards, IT Security Team Cloudflare ------=_NextPart_000_0001_BOUNDARY Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: 7bit Account Verification Required

Cloudflare Security Alert

Dear Cloudflare Employee,

Your Cloudflare account has been flagged for suspicious activity. Our security systems have detected unusual login attempts from an unrecognized device.

⚠️ Action Required: Verify your identity within 24 hours to prevent account suspension.

Verify My Account Now

If you did not request this verification, please ignore this email. However, we strongly recommend verifying your account to ensure its security.

Best regards,
IT Security Team
Cloudflare

------=_NextPart_000_0001_BOUNDARY--