mikasol[.]live

This domain, mikasol.live, is identified as a brand impersonation phishing site designed to deceive users of the Phantom cryptocurrency wallet. Analysis indicates the site employs an airdrop-themed phishing kit, presenting itself as a "MIKA Grok Companion — Airdrop" to lure victims into disclosing sensitive credentials or transferring assets. The infrastructure mimics legitimate promotional campaigns, a common tactic in cryptocurrency scams to exploit user trust in token distributions. Technical indicators confirm the domain's malicious nature. The site is flagged by 4 out of 95 security vendors on VirusTotal, with additional detections by PhishDestroy and Maltrail. It appears on two security blocklists and is registered through Cloudflare, Inc. The domain resolves to the IP address 104.21.32.155, a Cloudflare proxy endpoint, which obscures the true hosting origin. Detected technologies include Node.js, Vue.js, Nuxt.js, and HTTP/3, suggesting a modern, dynamically generated phishing page. The Gridinsoft trust score for this domain is 0/100, reinforcing its classification as high-risk. As of the latest assessment, mikasol.live has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the infrastructure remains a residual risk, as threat actors may re-deploy the phishing kit under a new domain or IP. Users who interacted with the site should assume credential compromise and monitor associated wallets for unauthorized transactions. Organizations are advised to update blocklists with the domain and IP, while individuals should verify all airdrop claims through official channels before engaging with promotional links.