heaven[.]mitosis[.]app

The domain heaven.mitosis.app was observed hosting a generic phishing page with the title "Heaven" and is classified as an investment scam. VirusTotal recorded a single positive detection out of 95 security vendors, indicating at least one scanner identified malicious behavior. The site was protected by Cloudflare and served content over HTTP/3, which can obscure origin details and complicate traffic analysis. DNS resolution points to IP address 188.114.97.3, an address owned by Cloudflare (AS13335) and located in the United States.

The SSL certificate was issued by Google Trust Services under the WE1 identifier, providing a valid TLS handshake but offering no assurance about the underlying content. Registration data shows the domain was registered through Web Commerce Communications Limited dba WebNic.cc, and the authoritative nameservers are april.ns.cloudflare.com and keenan.ns.cloudflare.com. The domain appears on a single public blocklist and has been actively blocked by PhishDestroy, suggesting that at least one anti‑phishing service has taken mitigation steps. Current status is offline, which may be temporary or a takedown response; however, the infrastructure remains observable and could be re‑activated.

Defenders should continue to block the domain and its resolving IP at network perimeter devices, monitor for re‑appearance of the host, and add the associated nameservers to threat‑intel feeds. Because only limited surface‑level data (page title, registrar, hosting, SSL) is available, further investigation of the payload, any credential‑stealing forms, or redirect chains is required to fully assess the threat. Continuous re‑scanning on platforms such as VirusTotal is recommended to capture any changes in detection rates, and any future sightings should be correlated with the existing blocklist entry to improve detection coverage.