mi-offers[.]com

mi-offers.com is currently listed as offline and has been classified as a generic phishing site with an elevated risk rating. The domain was registered on March 11, 2026 through Realtime Register B.V. and resolves to the IPv4 address 159.100.19.143, which is hosted in Germany by AS214036 Ultahost, Inc. The authoritative nameservers are nico.ns.cloudflare.com and stevie.ns.cloudflare.com, indicating the use of Cloudflare DNS services. An SSL certificate issued by Let’s Encrypt (R12) is present, providing HTTPS encryption but offering no assurance of legitimacy. The web server identifies as Apache HTTP Server and serves resources from Unpkg and AOS, suggesting reliance on common JavaScript libraries.

The page title observed during the brief crawl reads “Xiaomi — become a partner today!”, a clear indication that the site attempts to impersonate Xiaomi’s partner program to lure victims. VirusTotal analysis shows that one out of ninety‑five scanning engines flagged the domain, reinforcing the suspicion of malicious intent. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed, which aligns with its phishing classification. No additional public threat‑intel sources such as OTX or Safe Browsing entries were observed.

Because the site is offline, real‑time content inspection is not possible, and the exact phishing payload or credential‑capture mechanisms remain unknown. Defenders should continue to block the domain at perimeter defenses, monitor DNS queries for the associated IP and nameservers, and consider adding the IP address to network‑level deny lists. Ongoing observation of the registrar and hosting provider for any related domains is advised, as threat actors often reuse the same infrastructure. The limited detection footprint suggests a low‑volume campaign, but the elevated risk rating warrants proactive mitigation.