app[.]minepi[.]me

Analysis of the domain app.minepi.me, created on February 21, 2026 and hosted on Cloudflare infrastructure (AS13335, United States), indicates a high‑risk phishing operation that remains active as of the report date, July 24, 2026. The domain resolves to IP address 172.67.135.18, which is part of Cloudflare’s reverse‑proxy network and therefore masks the true origin of the payload. The authoritative nameservers ezra.ns.cloudflare.com and roxy.ns.cloudflare.com confirm the use of Cloudflare’s DNS services. An SSL certificate issued by Let’s Encrypt (R13) is present, providing encrypted transport but offering no assurance of legitimacy.

HTTP probing returned a 200 OK status while the page title reported "404 Not Found," suggesting that the site may serve content conditionally or employ evasion techniques. The MX record points to mx.plingest.com with priority 10, a mail server unrelated to the domain’s primary purpose and potentially used for credential harvesting. Reputation signals are strongly negative: Gridinsoft assigned a trust score of 0 out of 100, the domain appears on a known security blocklist, and PhishDestroy has explicitly blocked it. VirusTotal analysis shows that 1 of 93 scanning engines flagged the domain, reinforcing the suspicion of malicious activity.

The registrar listed is NameCheap, Inc., a common registrar for both legitimate and abusive domains. While the exact phishing payload or targeted brand is not disclosed in the available data, the convergence of a newly registered domain, Cloudflare masking, low trust scoring, blocklist presence, and a flagged detection collectively substantiate the high‑risk classification. Defenders should immediately block app.minepi.me at network perimeters, add it to endpoint and email filtering rules, and monitor for any related C2 communications. Continuous re‑evaluation is advised in case additional detections emerge from threat‑intel feeds.