memecreator[.]run

Analysis of memecreator.run indicates that the domain was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on Cloudflare infrastructure (AS13335) with the IP address 188.114.97.3 located in the United States. The authoritative nameservers are dolly.ns.cloudflare.com and nick.ns.cloudflare.com, and no TLS certificate is presented, implying that the site operates over plain HTTP. The page title returned by the server is “Just a moment…”, which is a common placeholder used by automated takedown or verification pages and does not provide functional content.

The domain is currently offline, but it was previously flagged by multiple security products: two of ninety‑three VirusTotal scanners reported malicious activity, and the site is listed on one public blocklist. Additional reputation signals include a Gridinsoft trust score of 0 out of 100 and an explicit block by the PhishDestroy service, both of which classify the domain as a phishing threat. No further behavioural data, such as observed payloads, credential‑stealing forms, or target brands, is available from the supplied intelligence.

Consequently, certainty exists regarding the domain’s malicious intent, its hosting environment, and its poor reputation scores, while the exact phishing methodology and victim profile remain unknown. Defenders should continue to block memecreator.run at network and DNS layers, monitor for any re‑appearance of the domain or associated IP addresses, and consider adding the IP 188.114.97.3 to deny‑list rules. Ongoing surveillance of Cloudflare‑hosted assets and periodic re‑scans with updated VirusTotal or similar services are recommended to capture any future changes in the domain’s status.