memerreum[.]pages[.]dev

Analysis of memerreum.pages.dev indicates an active high‑risk phishing campaign targeting cryptocurrency investors. The domain was registered on 29 April 2026 through Cloudflare, Inc., and is hosted behind Cloudflare’s network (IP 172.66.47.179, geolocated to Canada). DNS resolution uses the authoritative nameservers faye.ns.cloudflare.com and reese.ns.cloudflare.com, and the site presents a valid Google Trust Services certificate (WE1) with HSTS enabled and HTTP/3 support. The landing page returns HTTP 200 and carries the title “Memereum Presale Portal”, suggesting an attempt to lure victims into a crypto presale scam. Technological fingerprints include Statcounter analytics and Cloudflare services. VirusTotal has reported six detections out of ninety‑one scanners, and the site is listed on one external blocklist and has been blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious classification. Current evidence confirms the site functions as a crypto drainer phishing vector; however, the specific content of the page and any credential‑stealing mechanisms have not been publicly disclosed. Defenders should block the domain and its associated IP at perimeter and DNS layers, monitor for any related DNS queries, and consider adding the host to internal threat intel feeds. Ongoing observation is advised to capture any changes in infrastructure or payload delivery.