blackmirrorxp-claim[.]pages[.]dev

This domain, blackmirrorxp-claim.pages.dev, is flagged as a high‑risk brand‑impersonation campaign targeting Cloudflare. Infrastructure analysis shows the domain resolves to 172.66.44.89, an address owned by AS13335 Cloudflare, Inc., and is served through Cloudflare’s authoritative nameservers bailey.ns.cloudflare.com and cody.ns.cloudflare.com. The site presents a TLS certificate issued by Google Trust Services (WE1) and enforces HSTS while supporting HTTP/3, confirming legitimate use of Cloudflare services. The only publicly observable page response is an HTTP 500 error with the title “Worker threw exception | blackmirrorxp-claim.pages.dev | Cloudflare”, indicating a Cloudflare Workers runtime failure rather than a legitimate service page. The domain was created on 2025‑09‑08 via Cloudflare’s registrar and has a Gridinsoft trust score of 0/100. Threat intelligence shows it is listed on five security blocklists and has been blocked by PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. VirusTotal analysis recorded detections by 2 of 93 scanned vendors. The campaign is classified as a crypto‑scam, although the exact malicious payload or lures have not been disclosed. Defenders should treat the domain as malicious, enforce network‑level blocking, update URL filtering, and monitor for any additional subdomains that resolve to the same Cloudflare IP range. Continuous observation of DNS changes and certificate renewals is advised, as the attacker may leverage Cloudflare’s infrastructure to host further fraudulent content.