memomu[.]xyz

This domain, memomu.xyz, is flagged as a high-risk phishing infrastructure targeting users through a purported gaming platform. Registered on August 1, 2025, via NAMECHEAP INC, the domain remains active as of July 12, 2026, and resolves to IP address 185.199.108.153. The page title, 'MEMOMU Game,' suggests an attempt to lure victims with a gaming-related pretext, though the exact content and mechanics of the phishing operation are not yet analysed. The domain is associated with an SSL certificate issued by Let's Encrypt, a common feature in both legitimate and malicious sites, and is detected on two security blocklists, including PhishDestroy and BLP-Malware. Infrastructure analysis reveals the use of Firebase, Varnish, GitHub Pages, Unpkg, and Fastly, which may indicate an attempt to leverage legitimate cloud and CDN services to evade detection or improve scalability. The domain appears in 22 threat intelligence pulses on AlienVault OTX, signaling widespread recognition within the security community as malicious. While six of 95 security vendors on VirusTotal flag the domain, this detection rate does not confirm the absence of risk, particularly given the domain's presence on multiple blocklists and its recent registration. Defenders should prioritise blocking this domain at the network level, particularly in environments where gaming-related content is accessed. The use of GitHub Pages and Fastly suggests potential ties to distributed or rapidly changing infrastructure, which may require monitoring for related subdomains or IP shifts. Given the domain's age and continued activity, it is likely part of an ongoing campaign rather than a short-lived operation. Further analysis of the site's content, if accessible, could clarify the specific phishing techniques employed, such as credential harvesting or malware distribution.