mirabelsol[.]lol
“Mirabel | Airdrop”
mirabelsol.lol — 内容不可用. 品牌冒充:Revolut; 诈骗类型:Fake Airdrop. 证据摘要: VirusTotal 13/94 (alphaMountain.ai, AlphaSOC, BitDefender, Certego, CRDF); URLQuery 4 alerts; Spamhaus DBL_MALWARE; CF Radar malicious; PhishDestroy score 93/100. 注册商: PDR.
为保留原始取证记录,下方的 PhishDestroy AI 详细分析仍使用英文。
Analysis of the domain mirabelsol.lol indicates that it was registered on March 08 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and points to the Cloudflare‑owned address 188.114.96.3 (AS13335, United States). The authoritative nameservers are amos.ns.cloudflare.com and maya.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The site resolves to a page whose HTML title reads “Mirabel | Airdrop”, and automated fingerprinting identified the presence of Bootstrap, Cloudflare Browser Insights, Cloudflare services, and HTTP/3. The observed technology stack is consistent with a generic airdrop‑themed scam kit that has been catalogued as an “Airdrop Scam” kit.
VirusTotal scans show that 13 of 94 security engines flagged the domain, reinforcing the malicious classification. The domain is listed on one external security blocklist and is actively blocked by the PhishDestroy service. A Gridinsoft trust score of 0 / 100 further reflects a high confidence of abuse. The campaign impersonates Revolut and is labeled as a “Fake Airdrop” targeting users of that financial service.
Current network telemetry reports the domain as taken offline, but the infrastructure components (Cloudflare DNS, hosting IP) remain reusable for future campaigns. Defenders should continue to block the domain at perimeter filters, monitor any resurgence of the same IP or nameserver pair, and add the observed indicators—such as the page title, IP address, and the specific kit fingerprint—to detection rules. Since the site is already offline, the immediate risk is limited, yet the reuse of Cloudflare resources suggests that similar domains may appear, so continuous threat‑intel sharing and automated blocklist updates are advised.
网络安全情报
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| Cloudflare DNS | mirabelsol.lol |
malicious | Sinkholed |
| DigiCert UltraDNS | mirabelsol.lol |
malicious | Sinkholed |
| Hagezi Threat Feed | mirabelsol.lol |
malicious | Sinkholed |
| Quad9 DNS | mirabelsol.lol |
malicious | Sinkholed |
威胁响应 Pipeline
公共封禁名单状态
已保存的截图
域名情报
技术细节DNS、SSL SAN、时间戳
ICANN OVERSIGHT
认证和 RAA 背景
认证和 RAA 背景
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
取证情报
所用技术 · 4 identified
Popular CSS framework for responsive, mobile-first web development.
Performance monitoring tool that measures website speed from real users.
www.cloudflare.comWeb infrastructure and security company providing CDN, DDoS mitigation, and DNS services.
www.cloudflare.comThird major version of HTTP protocol, built on QUIC for faster, more reliable connections.
VirusTotal 分析
网站性能分析
Google PageSpeed Insights — mobile performance audit of mirabelsol.lol · checked Mar 15, 2026
证据与外部报告
PD-20260315-487C91 Recipient: abuse@publicdomainregistry.com 您是否受到本网站的影响?
如果您输入了帐户凭据、个人或付款信息,或者从此域下载了文件,请立即采取措施。以下资源可帮助您报告事件并保护自己。