sweaterrorfix[.]pages[.]dev

This domain, sweaterrorfix.pages.dev, was registered on July 08, 2025 and currently resolves to the Cloudflare edge IP 172.66.44.56 (AS13335). The site presents an HTTP 500 response with the title “Worker threw exception | sweaterrorfix.pages.dev | Cloudflare”, indicating it is hosted on Cloudflare’s Pages service and uses HSTS and HTTP/3. The TLS certificate is issued by Google Trust Services under the WE1 label, confirming a valid HTTPS endpoint. Google Safe Browsing classifies the URL as SOCIAL_ENGINEERING and nine of ninety‑three VirusTotal scanners have flagged it, reflecting a high confidence of malicious intent. The domain appears on one external blocklist and is already blocked by PhishDestroy. The nameservers harlan.ns.cloudflare.com and evelyn.ns.cloudflare.com are standard Cloudflare name servers, showing no custom infrastructure. The reported threat type is brand impersonation targeting Cloudflare, and the risk level is marked high. No additional payload or credential‑stealing page content has been observed; the only available artifact is the error page title, so the exact malicious behavior remains uncertain. Defenders should immediately block DNS resolution for sweaterrorfix.pages.dev, add the IP 172.66.44.56 to network deny lists, and monitor for similarly structured subdomains under the pages.dev namespace. Continuous monitoring of Cloudflare‑hosted assets for unexpected error pages and Google Safe Browsing alerts is advised, as is updating intrusion detection signatures to flag HTTP 500 responses originating from Cloudflare edge nodes that reference the target brand.