4-mir[.]org

Analysis as of July 24, 2026 identifies 4-mir.org as an active high‑risk generic phishing infrastructure. The domain resolves to the Cloudflare edge address 104.26.9.249, hosted in the United States under AS13335 Cloudflare, Inc. Registration information shows the domain was created on February 21, 2026 and is registered through Cloudflare, Inc., using the authoritative nameservers kara.ns.cloudflare.com and miguel.ns.cloudflare.com. HTTP probing returns a 301 redirect and the only observable page title is “Just a moment…”. No TLS certificate is presented, indicating the site is served without HTTPS.

Automated scanning on VirusTotal recorded two positive detections out of ninety‑three security vendors, and the domain appears on a single external blocklist. Independent scanning by Gridinsoft assigned a trust score of 0 out of 100, and the domain has been flagged by the PhishDestroy community blocklist. Detected web technologies consist of Cloudflare Browser Insights, the Cloudflare CDN, and HTTP/3 support. The evidence confirms that the domain is being leveraged for phishing, but the specific target brand or credential‑capture vector has not been disclosed in the available data.

Because the infrastructure relies on Cloudflare’s global network, the underlying host IP is shared with legitimate traffic, making IP‑based blocking less precise. Defenders should prioritize domain‑level mitigation: add 4-mir.org to DNS deny lists, enforce web‑proxy filtering, and monitor outbound traffic for connections to the 104.26.9.249 address. Continuous re‑scanning is advised to capture any changes in the threat posture, and security teams should retain the observed indicator set—including registration date, nameservers, HTTP status, and the “Just a moment…” title—for correlation with future campaigns.