fake-mirrors[.]net

This domain, fake-mirrors.net, is flagged as an active high-risk generic phishing site. Registered on April 28, 2026, through a registrar operating as Trustname.com, the domain resolves to IP address 104.21.74.93, which is hosted on Cloudflare infrastructure in Canada. The nameservers erin.ns.cloudflare.com and wesley.ns.cloudflare.com further confirm Cloudflare as the hosting provider, a common tactic to obscure origin and evade takedowns. The SSL certificate is issued by Let's Encrypt, providing HTTPS encryption that may lend false legitimacy to visitors. Analysis indicates the site is still operational, returning an HTTP 200 status, and its page title 'Fake Mirrors' suggests it may be impersonating software or file mirror services to distribute malicious payloads or harvest credentials. One security vendor on VirusTotal has flagged the domain, and it appears on at least one security blocklist, including PhishDestroy. Additionally, the domain is referenced in a threat intelligence pulse on AlienVault OTX, indicating prior detection in the security community. Defenders should treat this domain as malicious based on its infrastructure, detection history, and naming pattern. The use of Cloudflare complicates origin tracing, but the domain's registration details, nameserver configuration, and SSL certificate are consistent with phishing operations. No legitimate software mirror service would use such a transparently deceptive name. Network defenders are advised to block the domain and IP at perimeter controls, monitor for connections from internal assets, and investigate any prior interactions. Further analysis of the site's content is recommended to determine the exact payload or deception method, though current evidence supports immediate containment.