checker-met[.]app

Analysis of the domain checker-met.app indicates it is an active phishing infrastructure registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain currently resolves to the IP address 188.114.96.3, which is geolocated in Canada and associated with Cloudflare, Inc. Nameservers darl.ns.cloudflare.com and rachel.ns.cloudflare.com further confirm Cloudflare as the hosting proxy. The domain's SSL certificate is issued by Google Trust Services (WE1), a common configuration for malicious sites leveraging legitimate CDN services to obscure origin servers. As of July 12, 2026, the domain returns an HTTP 403 status with the page title 'Just a moment...', a default Cloudflare interstitial that often precedes phishing landing pages. No specific brand impersonation or scam category has been confirmed from the available metadata, though the domain is classified as generic phishing. Detection data from security vendors is limited but notable: seven of ninety-four engines on VirusTotal flag the domain as malicious, and it appears on one security blocklist (PhishDestroy). Additionally, AlienVault OTX records the domain in a single threat intelligence pulse, suggesting recent inclusion in shared indicators of compromise. The domain's trust score is rated 0/100, reinforcing its high-risk classification. While the exact phishing lure remains unconfirmed, the infrastructure aligns with patterns observed in credential harvesting or fraudulent verification portals. Defenders should treat this domain as actively hostile and prioritize blocking at the DNS or network level. Further analysis of payloads or redirect chains may clarify the specific threat actor or campaign objectives, but current evidence supports immediate containment measures.