1-mir[.]org

Analysis of the domain 1-mir.org, created on 21 February 2026 and hosted behind Cloudflare, shows multiple indicators of malicious use. The site resolves to the Cloudflare edge address 104.26.9.249, which is associated with AS13335 in the United States. DNS queries return the Cloudflare‑provided name servers kara.ns.cloudflare.com and miguel.ns.cloudflare.com, confirming that the domain is using Cloudflare’s DNS and CDN services. An HTTPS connection presents a certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS chain but offering no assurance of benign intent. When accessed, the HTTP response code is 403 and the page title returned is “Un instant…”, a generic phrase that does not reveal the intended victim target.

VirusTotal has recorded three detections out of ninety‑three scanned engines, and the domain appears on a single external blocklist. PhishDestroy has taken the domain offline, and current status reports confirm it is no longer reachable. The registrar listed is NiceNIC International Group Co., Limited, a known registrar that often hosts short‑lived malicious domains. No additional infrastructure such as dedicated mail servers or secondary IPs has been observed.

Because the site is presently offline, active exploitation cannot be verified, but the combination of a recent registration, Cloudflare front‑end, TLS certificate, and limited vendor detections matches patterns commonly seen in generic phishing campaigns. Defenders should continue to block 1-mir.org at network perimeter and DNS layers, monitor for any resurgence of the domain or related sub‑domains, and consider adding the observed IP address 104.26.9.249 to threat‑intel feeds if not already present. Ongoing observation of Cloudflare‑hosted assets linked to the same registrar may provide early warning of future campaigns. Until further evidence emerges, the domain should be treated as a high‑confidence phishing indicator.