foundation[.]mlranetwork[.]net

The domain foundation.mlranetwork.net is currently active and classified as high risk due to brand impersonation of Google. The site returns HTTP 200 and presents a page titled "Mira Airdrop Claim," which aligns with the known Airdrop Scam phishing kit. The malicious page is designed to lure victims into believing they are eligible for a Google‑related airdrop, a classic social engineering lure.

Technical analysis shows the domain was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to IP address 104.21.83.74, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain uses an SSL certificate identified as WE1, and its nameservers are ns1.verification-hold.suspended-domain.com and ns2.verification-hold.suspended-domain.com. Gridinsoft assigns a trust score of 0 out of 100, indicating no reputation.

Threat intelligence indicates the domain appears on two security blocklists—PhishDestroy and ScamSniffer—and has been flagged by 10 of 95 VirusTotal security vendors. The kit employed suggests a tech support scam overlay, potentially prompting victims to provide remote access or credentials under the guise of assistance. The combination of a low trust score, blocklist presence, and partial vendor detection underscores a credible malicious intent.

Defenders should immediately block DNS resolution for foundation.mlranetwork.net and the associated IP 104.21.83.74 at the network perimeter. Monitoring for outbound connections to Cloudflare IP ranges associated with this domain is advisable. Email filters should be updated to flag any messages referencing the "Mira Airdrop Claim" title or similar Google airdrop language. Continuous threat hunting for related indicators of compromise is recommended, as the full scope of victim interaction and payload delivery remains uncertain.