memedex[.]bond

Analysis on memedex.bond shows that the domain was registered on March 02, 2026 through Global Domain Group LLC and is hosted behind Cloudflare (ASN 13335). The site resolved to the IP address 188.114.96.3, which is located in the United States and belongs to Cloudflare, Inc. The web server responded with HTTP 200 and presented the default “Welcome to nginx!” title, indicating an uncustomized Nginx front‑end. The connection was protected by a Let’s Encrypt certificate issued under the E8 identifier, confirming the use of a publicly‑available TLS certificate. Cloudflare Browser Insights and HTTP/3 were detected, suggesting the infrastructure is leveraging modern CDN features. Reputation checks reveal a Gridinsoft trust score of 0 / 100 and the domain appears on three security blocklists.

It has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, and one of ninety‑three VirusTotal scanners flagged the domain as malicious. The nameservers listed are deborah.ns.cloudflare.com and uriah.ns.cloudflare.com. The site is currently reported as offline. The available data confirms that memedex.bond is being used for a generic phishing campaign, but no payload or credential‑harvesting page has been captured, leaving the exact lure or targeted brand unknown. Defenders should treat the domain as hostile: add the domain and its resolving IP (188.114.96.3) to DNS and web‑proxy blocklists, enforce Cloudflare‑based threat intelligence feeds, and monitor for any re‑appearance of the domain or similar subdomains registered by the same registrar.

Continuous scanning of the IP range used by Cloudflare may help catch future re‑hosted phishing kits. Because the SSL certificate is publicly issued, certificate pinning is not a viable mitigation. Organizations using URL filtering should ensure that the three blocklists that already contain memedex.bond are subscribed, and that endpoint protection solutions are updated to reflect the VirusTotal detection.