I think I just discovered a fairly large phishing network using #Cloudflare as the registrar. That hides the #WhoIs data.

Many domains are in use, so blocking or reporting one username@domain1.tld is ineffective, because the same email continues to be sent, the next time from username@domain2.tld. Each domain has an MX record from a subnet that provides a different IP for each mail.domain#.tld.

🧵 1/2