invite[.]urmenu[.]ir

Analysis of the domain invite.urmenu.ir indicates active phishing infrastructure targeting users through fraudulent menu or invitation-themed lures. The domain remains operational as of July 18, 2026, resolving to IP address 104.21.41.51, which is associated with Cloudflare's content delivery network. Nameserver records (decker.ns.cloudflare.com and nucum.ns.cloudflare.com) further confirm Cloudflare's role in hosting the domain's DNS infrastructure, a common tactic to obscure origin servers and evade takedowns. Security vendor detections on VirusTotal show 9 of 91 engines flagging the domain, though the specific nature of the threat—beyond its classification as generic phishing—remains unverified. The SSL certificate, issued by Google Trust Services (WE1), provides encryption but does not validate the legitimacy of the site's content. No brand impersonation or specific scam type (e.g., credential harvesting, payment fraud) has been confirmed in available data, and the exact content of the phishing page is not yet analyzed. Defenders should treat this domain as high-risk due to its active status, Cloudflare-hosted infrastructure, and vendor detections. Blocking the domain at DNS or proxy levels is recommended, along with monitoring for connections to 104.21.41.51. Further investigation into the site's content and any associated email or social engineering campaigns is advised to determine the precise threat vector.