memcn[.]pages[.]dev

The domain memcn.pages.dev has been identified as a credential theft phishing site. It was registered through Cloudflare, Inc. and is associated with the fake Memecoin brand. Analysis indicates that the site was designed to deceive users into revealing sensitive information such as login credentials and personal data.

Infrastructure analysis reveals that memcn.pages.dev has a VirusTotal score of 1/95, indicating a low level of detection among security vendors. The domain is registered through Cloudflare, Inc. and resolves to the IP address 188.114.97.3. It was created on March 26, 2026, and currently holds a Gridinsoft trust score of 0/100. The domain appears on 3 security blocklists, including MetaMask, PhishDestroy, and SEAL. The site employs various technologies, including Bootstrap, jsDelivr, jQuery, HSTS, crypto-js, cdnjs, Cloudflare, and Popper, which are commonly used in legitimate web development but can also be leveraged for malicious purposes.

The current status of memcn.pages.dev is offline, which may suggest that the operators have taken down the site in response to detection or as part of their operational cycle. Despite the site being offline, the risk remains elevated as the domain could be reactivated. Users are advised to avoid interacting with this domain and to monitor their accounts for any unauthorized activity. Security teams should continue to monitor for any resurrection of the domain and ensure that it remains blocked on all relevant systems.