mewxbet[.]com

Analysis indicates that mewxbet.com was registered on 21 February 2026 through Tucows Domains Inc. The site resolved to the Cloudflare edge address 188.114.96.3, associated with AS13335 in the United States. DNS resolution used the Cloudflare authoritative nameservers clay.ns.cloudflare.com and leah.ns.cloudflare.com. The TLS certificate presented by the host was issued by Google Trust Services under the WE1 intermediate, confirming the use of a valid HTTPS endpoint. The page title returned by the server was “MEWXBET: Login Page”, which aligns with the classified scam type of credential phishing. The underlying stack was identified as Node.js running behind Envoy, with a front‑end built on React and Next.js, and HTTP Strict Transport Security (HSTS) enabled.

Additional tracking components such as Facebook Pixel and Cloudflare Browser Insights were observed. VirusTotal recorded four detections out of ninety‑three scanning engines, indicating that multiple security products flagged the domain as malicious. The domain appears on a single external blocklist and has been added to the PhishDestroy blocklist. AlienVault OTX listed the domain in one threat‑intel pulse, providing further corroboration of its malicious use. The site’s current HTTP status is offline, which suggests that the phishing campaign has been taken down, but the infrastructure remains observable.

Defenders should continue to block the domain at perimeter filters, DNS resolvers, and proxy devices. Monitoring of the associated IP address 188.114.96.3 is advisable, as the Cloudflare edge may be reused for other malicious actors. Adding the domain to internal threat‑intel feeds and ensuring that endpoint protection solutions receive the VirusTotal detection signatures will help reduce exposure. Because the page content beyond the title has not been captured, analysts should treat any future re‑activation as potentially high‑risk and re‑evaluate the site promptly.