claim[.]blackmirrorway[.]xyz

Analysis date: July 24, 2026. The domain claim.blackmirrorway.xyz was registered through NameSilo, LLC and first observed on September 08, 2025. DNS resolution points to the Cloudflare edge address 104.21.72.68, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The authoritative nameservers are javier.ns.cloudflare.com and opal.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. No TLS certificate is presented; the HTTPS handshake fails, indicating the site operates without encryption. A single security vendor out of ninety‑five on VirusTotal flagged the domain, and the domain is currently listed on one public blocklist operated by PhishDestroy.

The page title returned by HTTP requests is “Just a moment…”, and the site has been taken offline as of the reporting date. The classification supplied in the intelligence set identifies the activity as a crypto scam, specifically a crypto drainer, which aligns with the observed infrastructure that often proxies monetary transactions through compromised or malicious wallets. Evidence is limited to the registration record, DNS configuration, IP ownership, and the single vendor detection. No additional payload samples, command‑and‑control endpoints, or malicious scripts have been publicly released. Consequently, the full scope of the campaign—including targeted wallets, transaction patterns, or victim demographics—remains unknown.

Defenders should immediately block claim.blackmirrorway.xyz at network perimeter and DNS filtering solutions. The associated IP 104.21.72.68, while part of a legitimate CDN, should be monitored for any sudden spikes in traffic to unknown subdomains. Continuous re‑query of Cloudflare’s DNS records is advised, as the attacker may shift the domain to another edge node. Inclusion of the domain in internal threat‑intel feeds and correlation with any outbound crypto‑related traffic can help identify compromised hosts.