A storefront could load normally while a script quietly redirected clicks or siphoned affiliate revenue. In a September 16 report, Cloudflare describes four malicious campaigns that its Page Shield machine-learning system detected in live traffic.
The cases covered eight payloads with different behaviors. Some waited for a particular location, device or referring page before acting. Others concealed affiliate requests, intercepted clicks or loaded further code from a remote server. The system flagged the scripts automatically, and people then verified the findings.
Cloudflare says later checks with other scanning services did not produce equivalent coverage: seven payloads were absent from VirusTotal, while URLScan showed no malicious verdict for the inspected cases. That comparison is the vendor’s investigation of these payloads, not a general ranking of the services.
The malicious behavior depended on conditions that a single visit or static check could miss, even when the page appeared to load normally.