meiwax[.]com

Analysis of meiwax.com confirms its classification as a phishing domain targeting social media users, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolved to Cloudflare IP 188.114.97.3 (AS13335, US). Infrastructure analysis reveals Cloudflare nameservers (grannbo.ns.cloudflare.com, kareem.ns.cloudflare.com) and a Google Trust Services SSL certificate (WE1), typical of phishing campaigns leveraging CDN protections. The HTTP status returned a 403 Forbidden response, and the page title explicitly states 'Suspected phishing site | Cloudflare,' aligning with automated detection mechanisms.

Security vendor detections include 16 flags from 93 engines on VirusTotal, though this count reflects only partial coverage and does not indicate full validation. The domain appears on one security blocklist (PhishDestroy) and is referenced in a single AlienVault OTX threat intelligence pulse, suggesting limited but targeted tracking. Gridinsoft assigns a trust score of 1/100, reinforcing its high-risk designation. While the exact social media platform targeted remains unconfirmed, the scam type is categorized as 'Social Media Phishing' in available intelligence.

Defenders should treat this domain as malicious and prioritize blocking resolutions to 188.114.97.3, along with monitoring for related subdomains or newly registered domains under the same registrar. The use of Cloudflare infrastructure complicates takedown efforts, but the current offline status may indicate temporary suspension or evasion tactics. Further investigation into associated IPs, SSL certificates, or registrar patterns could uncover linked campaigns. No evidence suggests this domain is part of a broader phishing kit or brand-specific impersonation beyond the social media classification.