Online shops and SaaS: when customers of one provider cannot log in or pay

Shops, SaaS and fintech apps are rarely blocked on purpose. They get caught: a provider blocks an address on a shared CDN (a network such as Cloudflare's that serves many sites from the same addresses) to stop someone else's site, or one new login or checkout page lands on a phishing list. Your uptime monitor stays green either way, because it checks from a datacenter whether your server answers.

Why is my site blocked when it was never the target?

Because it shares an IP address (a server's numeric address) with a site that was. In Spain, providers block the addresses of pirate football streams during broadcasts. OONI, an open censorship-measurement project, found that between 1 January and 1 June 2026 this made 554,507 domains unreachable at some point, 5.8% of 9.2 million popular domains tested. 90.4% of them were on Cloudflare, and blocking 4 to 20 addresses for one hour affected more than 400,000 unrelated domains. In September 2025 RedesZone listed the online shop Miravia among the sites hit; in April 2026 Xataka reported that the blocks had again hit Docker and GitHub.

Sources: OONI, 30 June 2026 · RedesZone, 22 September 2025 · Xataka, 15 April 2026

Elsewhere: in August 2022 Austrian providers blocked Cloudflare addresses under an anti-piracy order, cutting off many unrelated sites. More cases: collateral blocking in Europe.

Source: TorrentFreak, 29 August 2022

What do those customers see, and why are my logs empty?

Usually an error, not a notice. During a matchday block in Spain, Movistar and O2 silently drop the connection, so the page loads until the browser gives up. DIGI answers with a certificate of its own that browsers do not trust, so your checkout appears behind a security warning; OONI found this on 7,334 addresses hosting 10,759 domains. Blocked visits never reach your server, so your logs show nothing. In April 2025 OnlyTenis.com, a sports shop on a paid Cloudflare plan, told Xataka that a customer whose page loads but who cannot check out goes to another shop. Its commerce manager said revenue had been 70,000 euros a month and was 40,000 or 50,000 that month, and called the link to the blocks very hard to prove.

Sources: OONI, 30 June 2026 · RedesZone, 22 September 2025 · Xataka, 22 April 2025

How do I confirm a block on a shared CDN address?

Test while the block is on: in Spain, on Movistar, Orange, Vodafone and DIGI during a live broadcast and after it; outside a broadcast a test usually shows nothing. Collect evidence: the provider, home or mobile, the time and what the customer saw. Ask your CDN or host whether your address is shared with other sites.

Source: OONI, 30 June 2026

Why is only my login or checkout page flagged as phishing?

Because a warning can sit on one page address while the rest of the domain stays clean. Search Console's Security issues report lists sample URLs for each issue; its warning "Possible phishing detected on user login" means a password reuse warning fired when a user signed in on one of your pages. On a hacked site, Cloudflare usually puts its "Suspected phishing" warning in front of one URL, not the whole domain.

Sources: Search Console Help, Security issues report, checked 11 November 2026 · Google Search Central, Social engineering, updated 10 December 2025 · Cloudflare Blog, 27 February 2019

The cost is most of that page's visitors: in a study of over 25 million warning impressions, users went past only about 1 in 4 Chrome and 1 in 10 Firefox malware and phishing warnings. Fix the cause, then ask for a review: Google in Search Console, Microsoft from "More information" on Edge's warning page, Cloudflare on the Blocked Content page. Step by step: "Deceptive site ahead", SmartScreen "reported as unsafe", Cloudflare "Suspected phishing".

Sources: D. Akhawe, A. P. Felt, "Alice in Warningland", USENIX Security 2013 · Search Console Help, Security issues report, checked 11 November 2026 · Microsoft Learn, 28 January 2026 · Cloudflare Docs, Blocked Content, updated 1 May 2026

Which pages should you watch, and for what?

A ticket saying "your site does not open on Vodafone" has three possible owners: down everywhere is your hosting, blocked is a provider, regulator or CDN, and a challenge from your own bot protection is yours to tune (mobile customers who share one address can trip it: works on Wi-Fi, not on mobile data). Keep watching:

• Full page addresses. Login, checkout, payment return pages and sign-in subdomains, not only the home page.
• Each provider, home and mobile. Blocks and filters live inside each provider's network.
• Whose certificate arrives. Yours, or one that somebody on the path put in its place.

Keep your uptime monitor for outages; provider-level checks complement it, not replace it (why datacenter monitors miss ISP blocks).

What linkspect answers for shops and SaaS

linkspect opens the full URL of your login or checkout page through home and mobile connections of named providers in the countries open today, and answers per provider: opened with your own certificate, stopped by the provider or a CDN, down everywhere, or refused by your bot protection. Every check also looks the URL and domain up in Google Web Risk; through the API (not with test keys or in the free check on this site), real Chrome and Edge open the page and report their warnings with a screenshot. A monitor repeats a check every 15 minutes to once a day and sends a change, after a confirming re-check, to a signed webhook; 20 monitors per account by default. In Spain a check cannot yet confirm IP blocks during football broadcasts; at most it says the connection failed in a way that looks like one. Early access is free and keys are handed out by hand: get early access or read the API.