edge[.]momentumwe[.]com

This domain, edge.momentumwe.com, is flagged as an active high-risk phishing site impersonating the Scroll brand. Registered on November 2, 2022, through Squarespace Domains LLC, the domain remains operational as of July 12, 2026, resolving to IP address 172.64.152.166. The site presents a page titled 'MOMENTUM EDGE,' which aligns with known brand impersonation tactics targeting Scroll users. Analysis indicates the domain is hosted on infrastructure leveraging Cloudflare, Google Cloud, and Node.js, with additional technologies including Vue.js, Nuxt.js, and HighLevel detected. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious domains to evade initial suspicion. Security vendor assessments reinforce the malicious classification, with 6 out of 95 engines on VirusTotal flagging the domain. It appears on two security blocklists and is actively blocked by at least two threat intelligence feeds. The Gridinsoft trust score of 0/100 further supports the domain's high-risk status. While the exact content and mechanics of the phishing operation are not yet analyzed, the combination of brand impersonation, recent detection by security tools, and persistent activity indicates a deliberate attempt to deceive users associated with the Scroll brand. Defenders should treat this domain as a confirmed phishing threat. Immediate actions include blocking the domain and its resolving IP at the network perimeter, updating endpoint protection rules, and monitoring for related indicators of compromise. The use of Cloudflare and Google Cloud infrastructure suggests potential resilience to takedown efforts, necessitating proactive detection and response measures. Organizations should also review logs for any prior connections to this domain or its associated IP to assess potential exposure. Given the domain's age and continued activity, it may represent a long-term campaign rather than a transient phishing attempt.