buio-astro[.]pages[.]dev

The domain buio-astro.pages.dev was registered on 20 January 2026 and is currently active. It resolves to 188.114.97.3, an IP owned by Cloudflare, Inc. in Canada and is served through Cloudflare’s infrastructure, using the nameservers duke.ns.cloudflare.com and stella.ns.cloudflare.com, and a Google Trust Services TLS certificate (WE1). The page title returned by HTTP 200 is "Your Page Title," and the site presents itself as an impersonation of the Cloudflare brand. VirusTotal scans show four of ninety‑one security vendors flag the domain, and it is listed on a single security blocklist. Independent analysis by PhishDestroy has already blocked the domain, and Gridinsoft assigns it a trust score of 0 / 100, supporting a high‑risk classification. The available evidence indicates the domain is being leveraged for brand‑impersonation tactics, likely to harvest credentials or lure victims through a fraudulent Cloudflare‑related narrative, though the exact content and payload have not been publicly disclosed. Defenders should proactively block the domain at the DNS or proxy level, incorporate it into URL filtering rules, and monitor for any additional subdomains under pages.dev that target Cloudflare or related services. Continuous threat‑intel feeds should be consulted for emerging variants, and incident response teams should be prepared to investigate any related credential‑theft attempts originating from this infrastructure.