fourmeme[.]mom

Analysis of the domain fourmeme.mom, observed on July 25, 2026, indicates that it was used for a Binance brand impersonation campaign targeting wallet or seed credentials. The site is currently offline, returning no HTTP response, and therefore cannot be accessed for direct content verification. Registration data shows the domain was created on December 16, 2025 and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com. Authoritative nameservers cody.ns.cloudflare.com and nora.ns.cloudflare.com resolve the domain to IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States.

No SSL certificate is presented for the host, leaving the connection unencrypted if the site were to become reachable. The page title retrieved prior to takedown reads "Four.meme: Best Memecoin Launchpad on BNB Chain | Create & Launch Tokens," which aligns with the advertised crypto‑related service but does not directly reference Binance. Threat intelligence feeds have listed the domain on two security blocklists, specifically PhishDestroy and ScamSniffer, confirming its classification as a malicious resource. VirusTotal analysis shows that seven of ninety‑three security vendors flagged the domain, reinforcing the malicious assessment.

Additionally, Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of abuse. The campaign’s primary objective appears to be wallet or seed phishing, leveraging the Binance brand to lure victims into disclosing private keys or recovery phrases. While the exact phishing page layout and credential collection mechanisms remain unknown due to the site’s offline status, the combination of brand impersonation, malicious blocklist listings, low trust score, and vendor detections provides sufficient evidence for defensive action. Organizations should block traffic to fourmeme.