join-blackmirrorxp[.]xyz

Analysis of join-blackmirrorxp.xyz indicates that the domain was registered on February 21, 2026 and is currently listed as offline. The site served a page whose title was observed as "Black Mirror". Network resolution points to the IP address 172.67.172.93, which belongs to the Cloudflare, Inc. network (AS13335) located in the United States. The domain is associated with an SSL certificate identified as WE1, suggesting the use of HTTPS for client connections.

Threat intelligence sources have placed the domain on two security blocklists, specifically PhishDestroy and ScamSniffer, and it appears on a total of two blocklists. VirusTotal scans reported that five out of ninety‑three security vendors flagged the domain, providing additional confirmation of malicious intent. The classification provided is generic phishing, consistent with the presence of blocklist entries and vendor detections. While the site is no longer reachable, the historical infrastructure—Cloudflare hosting and the observed SSL certificate—remains reusable for future campaigns.

Defenders should therefore continue to enforce DNS‑level blocking for join‑blackmirrorxp.xyz, monitor outbound connections to the associated IP address, and consider adding the domain and its IP to local threat‑intel feeds. Ongoing observation of the Cloudflare AS13335 range for similar patterns is recommended, as the same hosting provider is frequently abused by phishing operators. Because the page content beyond the title has not been captured, further forensic collection would be required to determine the exact credential‑harvesting mechanisms employed. In the absence of additional evidence, the available indicators—registration date, blocklist presence, vendor detections, and IP ownership—provide sufficient justification for elevated risk handling.