10-mir[.]org

Analysis of the domain 10-mir.org, created on 21 February 2026 and currently taken offline, indicates it was used in a phishing operation that was intercepted by security tooling. The domain resolves to the IP address 188.114.96.3, which belongs to Cloudflare’s network (AS13335) and is geolocated in the United States. No TLS certificate is presented for the host, meaning all HTTP traffic would have been unencrypted. The authoritative name servers are kara.ns.cloudflare.com and miguel.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. The registrar listed for the registration is NiceNIC International Group Co., Limited.

Two of ninety‑five security vendors on VirusTotal flagged the domain, and the domain appears on a single external blocklist, indicating that at least a modest number of detection engines observed malicious characteristics. PhishDestroy has also listed the domain as blocked, reinforcing the conclusion that the site was engaged in phishing activity. The page title returned by the HTTP request is “Just a moment…”, a generic placeholder that provides no insight into the intended victim‑facing content. No additional intelligence such as targeted brands, specific phishing kits, or payload URLs is available at this time. Uncertainty remains regarding the exact phishing vector, the credentials or data the site attempted to harvest, and whether any victim interaction occurred before the domain was taken offline.

The lack of a TLS certificate and the generic page title suggest a quickly deployed site, possibly used for a short‑lived campaign. Defenders should continue to monitor the associated IP address (188.114.96.3) for any resurgence of malicious activity, enforce blocklists that include 10-mir.org, and consider adding the IP to network‑level deny lists.