top-meme[.]fun

Analysis of top-meme.fun reveals infrastructure consistent with brand impersonation targeting Google, classified as elevated risk. The domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abusive registrations. It resolves to IP 172.67.184.153, hosted on Cloudflare's network (AS13335), a common proxy service used to obscure phishing origins. No SSL certificate is present, increasing the likelihood of interception or tampering during data transmission.

The page title 'Google' directly matches the targeted brand, reinforcing the impersonation intent. The domain appears on one security blocklist (PhishDestroy) and is flagged by 5 of 93 security vendors on VirusTotal, indicating detection by multiple independent engines. Nameservers (carlos.ns.cloudflare.com, lila.ns.cloudflare.com) further confirm Cloudflare's role in hosting the infrastructure. At the time of assessment, the domain is offline, though this status may change; defenders should treat it as compromised until verified otherwise.

While the exact content of the site remains unanalyzed, the combination of registration details, hosting provider, lack of encryption, and explicit brand targeting provides concrete evidence of phishing activity. Organizations should block the domain at the DNS level, monitor for re-emergence, and review logs for prior connections to 172.67.184.153 or related Cloudflare IPs. No evidence suggests the use of a phishing kit or additional payloads, but the infrastructure aligns with known impersonation tactics.