mumucoin[.]org

Analysis indicates that the domain mumucoin.org was registered on February 21, 2026 and resolves to the IP address 104.21.57.3. The IP is owned by Cloudflare, Inc. (AS13335) and is located in the United States. TLS negotiation presents a certificate issued by GTS CA 1P5, confirming the use of a valid SSL chain. A simple HTTP request returns the page title "MUMU"; no further page content has been disclosed.

The domain is listed on two security blocklists and is explicitly flagged by PhishDestroy and Enkrypt, reinforcing its classification as a phishing‑related resource. VirusTotal records show that the URL was scanned by 95 antivirus and URL‑reputation vendors, none of which reported a detection at the time of scanning. The site is currently offline, which may be an intentional takedown or a temporary unavailability. Uncertainties remain regarding the specific phishing payload, the target audience, and whether the domain has been used to host credential‑stealing forms or redirect traffic to other malicious infrastructure, as no content analysis or payload evidence is available.

Defenders should continue to block the domain at DNS or proxy layers, consider adding the associated IP address 104.21.57.3 to network‑level deny lists, and monitor Cloudflare‑owned address ranges for re‑use of the same IP by other suspicious domains. Ongoing surveillance of the two blocklists that listed the domain, as well as periodic re‑scanning with multi‑vendor services, is advised to detect any resurgence. Integrating this indicator into existing threat‑intel feeds will help reduce exposure to similar phishing campaigns while the offline status is verified.