mufuum[.]com

This investigation documents the malicious infrastructure associated with mufuum.com, observed as a generic phishing site. The domain was registered on 27 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 188.114.97.3, which is announced by AS13335 (Cloudflare, Inc.) and geolocated to the United States. The authoritative name servers are phil.ns.cloudflare.com and sneh.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. No TLS certificate is presented; HTTP requests return the page title “Just a moment…”, suggesting a placeholder or redirection page rather than a fully rendered phishing landing page.

The site has been flagged by PhishDestroy and appears on a single security blocklist. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis shows that 2 of 93 scanned security vendors flagged the domain, confirming that at least a minority of scanners recognize it as suspicious. The domain is currently listed as offline, and the risk level is classified as elevated.

Evidence is limited to the infrastructure details and the modest detection rate; the content of the page has not been publicly released, and no SSL certificate or additional payload indicators have been observed. Consequently, the exact phishing vector, targeted brand, or credential‑harvesting technique remains unknown. Defenders should continue to block connections to 188.114.97.3, enforce DNS‑based filtering for mufuum.com, and monitor Cloudflare‑associated IP ranges for similar patterns. Organizations using URL filtering should add the domain to blocklists, and incident response teams should treat any traffic to the domain as potentially malicious, especially given the zero trust score and confirmed detections.