{
  "schema_version": "1.1",
  "id": "cloudflare-deceptive-links-in-52-percent-of-malicious-emails-2025",
  "slug": "cloudflare-deceptive-links-in-52-percent-of-malicious-emails-2025",
  "url": "https://groundedkit.com/claims/cloudflare-deceptive-links-in-52-percent-of-malicious-emails-2025/",
  "api_url": "https://groundedkit.com/api/claims/cloudflare-deceptive-links-in-52-percent-of-malicious-emails-2025.json",
  "claim": "Deceptive links appeared in 52% of malicious emails in 2025; brand impersonation in 32%",
  "commonly_cited_as": "\"Brand impersonation in phishing is rising\"",
  "verdict": "verified",
  "verdict_definition": "Primary source found; it says the same thing, the scope matches, and it is reasonably current.",
  "confidence": "high",
  "rating": {
    "value": 5,
    "best": 5,
    "worst": 1
  },
  "origin": {
    "publisher": "Cloudflare Radar",
    "title": "Cloudflare Radar 2025 Year in Review",
    "year": "2025"
  },
  "quote": "Deceptive links were the top malicious email threat category in 2025 , found in 52% of messages, up from 43% in 2024 . ... Identity deception (38%) and brand impersonation (32%) were growing threats in 2025, up from 35% and 23% respectively in 2024.",
  "method": "Malicious messages identified by Cloudflare Email Security, 2025; a message can fall into several categories.",
  "drift": [
    "Shares of malicious messages, not of all email; categories overlap"
  ],
  "interest": "Cloudflare sells network and security services.",
  "safe_rephrasing": "Among malicious emails Cloudflare caught in 2025, 52% contained deceptive links, 38% identity deception and 32% brand impersonation (up from 23% in 2024).",
  "sources": [
    {
      "title": "Cloudflare Radar 2025 Year in Review",
      "url": "https://blog.cloudflare.com/radar-2025-year-in-review/",
      "primary": true
    }
  ],
  "kind": "reference_fact",
  "as_of": "2025 (year to date, through early December)",
  "last_checked": "2026-10-17",
  "stale": false,
  "date_reviewed": "2026-10-17",
  "license": "CC BY 4.0",
  "license_url": "https://creativecommons.org/licenses/by/4.0/"
}