metammkogllin[.]webflow[.]io

On July 23, 2026, investigators evaluated the domain metammkogllin.webflow.io, which is currently listed as offline. The domain was registered through MarkMonitor, Inc. on May 08, 2013 and resolves to the IP address 172.64.151.8, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. DNS resolution uses the Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. HTTP requests to the host return a 404 status code with the page title "404 - Page not found," indicating no visible content was served at the time of testing. The site is protected by a Google Trust Services certificate issued to the WE1 entity, and the observed transport layer utilizes Cloudflare and HTTP/3 technologies.

Security telemetry shows that 15 of 95 VirusTotal scanners flagged the domain, and it appears on one external security blocklist. The blocklist entry originates from PhishDestroy, which has actively blocked the domain. No additional public threat‑intel feeds (such as OTX or Google Safe Browsing) are cited in the available data. The limited visible surface—primarily a 404 response—precludes direct observation of phishing payloads or credential‑harvesting pages, leaving the specific phishing campaign details uncertain. Nonetheless, the combination of multiple vendor detections, blocklist inclusion, and the historical use of the webflow.io sub‑domain for phishing infrastructure justifies an elevated risk rating.

Defenders should continue to block the domain at network perimeter and endpoint filters, monitor the associated IP address for any future content changes, and consider adding the host to internal blocklists. Ongoing VirusTotal rescans and periodic re‑resolution checks are recommended to detect any re‑activation. Given the Cloudflare hosting, sinkholing the IP may not be feasible, but correlation with other Cloudflare‑hosted phishing domains could aid attribution.