This Pulse documents a large set of domains and IP addresses associated with malware delivery activity leveraging Cloudflare‑fronted infrastructure. Observed indicators include Cloudflare‑proxied domains across multiple TLDs (notably .top, .click, .life, and .ru‑related subdomains) used for hosting or delivering executable payloads, including first‑stage loader binaries. Network telemetry shows successful HTTP(S) responses from these domains, consistent with initial access or malware distribution behavior. The infrastructure demonstrates common characteristics of commodity eCrime operations, including high domain churn, short‑lived subdomains, and reuse of shared Cloudflare edge IPs to obscure true origin servers.