checafoto[.]com

Analysis as of July 24 2026 indicates that checafoto.com is currently taken offline. The domain was registered on 22 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare edge address 172.67.223.26, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. No TLS certificate is presented; HTTPS connections terminate without a valid certificate, which matches the absence of an SSL record in the intelligence feed. Authoritative name servers are felicity.ns.cloudflare.com and melinda.ns.cloudflare.com, both operated by Cloudflare.

The site’s HTML title, “Checa Foto - Encontre Pessoas Online por Foto”, suggests a photo‑search service, but no further content analysis is available. The domain appears on a single public blocklist and is specifically listed by the PhishDestroy feed. VirusTotal analysis returned detections from three of ninety‑five scanning engines, confirming malicious intent despite the relatively low count. The three detections, though unnamed, indicate that multiple security products have flagged the domain as hosting phishing‑related content.

Given the combination of recent registration, Cloudflare hosting without TLS, blocklist inclusion, and multiple vendor detections, the domain should be treated as a confirmed phishing infrastructure. Defensive actions include adding the domain to network deny lists, configuring DNS sinkholing for 172.67.223.26, and monitoring for any re‑appearance of the host under a different subdomain or IP. Although the site is offline, the underlying infrastructure may be reused for future campaigns; continuous observation of the associated Cloudflare IP range and the registrar’s new registrations is recommended. The short lifespan of roughly five months aligns with typical throwaway phishing sites, and no evidence of additional command‑and‑control or payload hosting has been observed.