phomtq-walettio[.]webflow[.]io

phomtq-walettio.webflow.io is currently offline, returning HTTP 404. The domain was created on May 08 2013 and is registered through MarkMonitor, Inc. It resolves to 104.18.36.248, an address owned by Cloudflare, Inc. (AS13335) located in the United States. DNS is served by journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS configuration despite the site being taken down. Technology fingerprints show Cloudflare’s edge services and HTTP/3 support.

The only visible page title is “phomtq‑walettio”, providing no further context about the site’s purpose. Security intelligence lists the domain on one public blocklist and records a detection by PhishDestroy. VirusTotal analysis shows that ten of ninety‑five scanners flagged the domain, reinforcing the suspicion of malicious use. The presence on a blocklist and the PhishDestroy flag demonstrate that security communities have already taken action against the domain. No public Safe Browsing or Open Threat Exchange entries were supplied.

The evidence points to a phishing‑related infrastructure, but the exact payload or targeted brand cannot be confirmed because the site content has not been captured. Defenders should immediately block the domain at network perimeter and DNS resolvers, monitor for any resurrection of the host, and consider adding the IP address 104.18.36.248 to reputation lists, noting that Cloudflare may host other unrelated services. Ongoing observation of the registrar’s activity and any future TLS certificate changes is advised to detect potential re‑use. Until further forensic content is obtained, the domain should be treated as a confirmed phishing resource.