memapex[.]com

memapex.com is currently listed as an active brand-impersonation site targeting the x.com brand. The domain was registered on 02 October 2025 through Dominet (HK) Limited and resolves to the Cloudflare edge address 188.114.97.3, belonging to AS13335. The authoritative nameservers are james.ns.cloudflare.com and meiling.ns.cloudflare.com, indicating that the site is fully hosted behind Cloudflare’s network.

The web server returns HTTP 200 for the root URL and presents the page title “Pieni hetki…”. No TLS certificate is presented, meaning the site operates over plain HTTP despite being reachable via Cloudflare. The lack of encryption, combined with a Gridinsoft trust score of 0 / 100, suggests a deliberately low‑trust infrastructure. The domain appears on a single public blocklist and has been flagged by PhishDestroy as a malicious entry.

VirusTotal analysis shows that 3 out of 95 security vendors have flagged the domain, reinforcing the suspicion of malicious intent. The explicit classification as a “Social Media Phishing” campaign aligns with the observed brand impersonation of x.com. The combination of a generic page title, a high‑risk label, and the presence on a security blocklist provides concrete evidence that the domain is being used to harvest credentials or lure users through deceptive social‑media channels.

Open questions remain regarding the exact content served to victims, as the page has not been publicly dissected and no SSL certificate obscures traffic inspection. Defenders should immediately block memapex.com at network perimeter and DNS layers, monitor for any outbound connections to the Cloudflare IP range, and incorporate the domain into threat‑intel feeds. Continuous re‑evaluation is advised in case additional indicators, such as increased vendor detections or new blocklist entries, emerge.