Site-owners MUST invalidate all their users sessions and tokens now, and might want to consider doing so again in the not distant future.
There has been a great deal of discussion about the Cloudflare domain lists that are being constructed. These lists are not really all that useful for cleaning up this mess. Let me explain.