checker-mitosis[.]org

The domain checker-mitosis.org was registered on 17 August 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 104.21.82.219, which belongs to AS13335 Cloudflare, Inc. and is therefore hosted on a CDN service located in the United States. The site presented the HTTP title “Just a moment…”, a generic placeholder often used by malicious actors to defer content loading. The SSL certificate associated with the host is identified as “WE1”, indicating a standard Cloudflare‑issued certificate without further validation.

Reputation signals are strongly negative: Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on two independent blocklists, specifically PhishDestroy and ScamSniffer. VirusTotal analysis shows that 2 of 93 scanning engines flagged the domain, confirming the presence of at least one suspicious indicator. The current operational status is reported as taken offline, which limits immediate payload retrieval but does not eliminate the risk of re‑activation or reuse of the underlying infrastructure. The evidence does not include any publicly disclosed payload, target brand, or detailed page content, leaving the exact phishing vector undefined.

Defensive teams should therefore treat the domain as hostile, enforce network‑level blocking of both the domain name and its resolved IP address, and monitor for any future DNS changes or re‑hosting on the same Cloudflare ASN. Continuous observation of the associated certificate and blocklist entries is advised, as the infrastructure could be repurposed for new campaigns. The combination of recent registration, low trust rating, blocklist inclusion, and partial VirusTotal detections warrants an elevated risk classification despite the offline state.