four-meme[.]xyz

The domain four-meme.xyz was registered on February 21, 2026 and is currently resolved to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presented the page title "Nur einen Moment…" and was subsequently taken offline. Threat intelligence sources have recorded the domain on a single security blocklist and it has been actively blocked by the PhishDestroy service. SSL analysis shows the certificate labeled WE1, indicating a standard TLS deployment without extended validation.

Two of ninety-three security vendors on VirusTotal flagged the domain, providing early indication of malicious intent. Independent scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting a complete lack of confidence in the site's legitimacy. The combination of a recent registration date, Cloudflare hosting, a minimal blocklist presence, and low trust metrics aligns with typical infrastructure patterns observed in generic phishing operations.

While the exact phishing lure or targeted brand has not been disclosed, the available evidence is sufficient to classify the domain as a confirmed phishing site. Defenders should continue to block the domain at perimeter defenses, monitor for any re‑activation attempts, and add the associated IP address to deny‑list rules. Ongoing surveillance of related Cloudflare‑hosted assets and periodic re‑scans with multi‑vendor services are recommended to capture any evolution of the threat actor's infrastructure.