imeow[.]mempump[.]fun

Analysis of imeow.mempump.fun, first observed on July 22, 2026, indicates an active generic phishing infrastructure with a high risk rating. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and is serviced by Cloudflare DNS, using the authoritative nameservers ariadne.ns.cloudflare.com and ignacio.ns.cloudflare.com. DNS resolution points to the IP address 104.21.1.193, a Cloudflare edge node that frequently hosts malicious payloads due to its shared hosting model.

VirusTotal reports that one out of ninety‑one security vendors flagged the domain, providing the only vendor‑based detection evidence currently available. The domain also appears on a single external blocklist and has been explicitly blocked by the PhishDestroy mitigation service, confirming that at least one security community has identified it as malicious. No public page title, SSL certificate details, or HTTP response codes have been disclosed, leaving those surface‑level indicators unverified at this time.

The limited detection footprint suggests that the domain may be employing fast‑flux or low‑profile hosting techniques to evade broader attribution, but the presence of a Cloudflare front end and a registrar that offers rapid, low‑cost registrations are consistent with typical phishing campaign setups. Defenders should prioritize adding imeow.mempump.fun to URL filtering and DNS sinkhole rules, monitor for any changes in its DNS records, and consider broader threat‑intel correlation with other domains that resolve to the same IP range. Continuous re‑scanning on multi‑vendor platforms is recommended to capture any future detections that may arise as threat actors evolve the payload or hosting configuration.