checker[.]confidentiallayer[.]com

Analysis of checker.confidentiallayer.com indicates a high-risk phishing domain impersonating a secure mail verification service, as suggested by its page title 'Confidential Layer'. The domain was registered on February 21, 2026, through NameCheap, Inc., and remains active as of July 24, 2026. Infrastructure analysis reveals the domain resolves to IP address 66.33.60.35, hosted on Amazon.com, Inc. (AS16509) in the United States, with Cloudflare nameservers (cody.ns.cloudflare.com, saanvi.ns.cloudflare.com). The site employs a Let's Encrypt SSL certificate (R13) and enforces HSTS, which may lend a false sense of legitimacy to targets. A 307 HTTP status code suggests temporary redirection, though the destination remains unconfirmed.

Detection data is limited but notable: one security vendor on VirusTotal flags the domain, and it appears on a single security blocklist (PhishDestroy). Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. Technologies detected include Proton Mail and Vercel, which may indicate an attempt to mimic legitimate encrypted communication platforms. The exact content and target of the phishing campaign are not yet fully analyzed, though the page title implies a focus on confidential or secure data verification. Defenders should treat this domain as active and malicious.

Block the domain and its resolving IP (66.33.60.35) at the network level. Monitor for related subdomains or newly registered domains under the same registrar (NameCheap, Inc.) or hosting provider (Amazon AS16509). Given the use of Cloudflare and Let's Encrypt, SSL inspection may be required to identify and block malicious traffic. Security teams should review logs for connections to this domain, particularly from users accessing mail or secure document services, and investigate any associated credentials or data submissions for compromise.