I recently investigated a campaign abusing Cloudflare Pages (pages[.]dev) to host benign looking SEO blog content that displays a delayed "Continue Read" modal.
The click gated interaction redirects users into a shared backend redirector, which conditionally routes traffic to phishing pages, adware/PUP installers, fake browser download lures, and QR based social engineering flows.
Click to Open Code Editor