memowex[.]com

PhishDestroy identifies memowex.com as an active credential theft domain impersonating the Memo brand. The site is currently under investigation and remains unblocked by most security vendors as of this analysis. This domain was flagged by 1 of 95 VirusTotal vendors and uses a Let’s Encrypt SSL certificate. memowex.com was registered on 2024-05-15 via Namecheap, resolving to IP 162.241.144.131. It has been detected on 2 blocklists and holds a low trust score of 1/100 according to Scamadviser. While VirusTotal detection remains low, the domain’s active status and impersonation of Memo—combined with its recent registration and poor reputation—indicate high potential for credential harvesting. Users should avoid accessing memowex.com, report the domain to hosting providers and security teams, and implement DNS filtering rules to block the IP and domain. Organizations are advised to monitor for related phishing campaigns and update threat intelligence feeds accordingly.