uni-sres-info[.]webflow[.]io

The domain uni-sres-info.webflow.io is registered through MarkMonitor, Inc. with creation date May 08, 2013 and uses Cloudflare authoritative nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. DNS resolution points to IP address 172.64.151.8, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The web service presents an SSL certificate issued by Google Trust Services under the WE1 designation, indicating a valid TLS handshake. HTTP probing returns a 404 status code and the page title "404 - Page not found," while fingerprinting detects Cloudflare’s edge network and HTTP/3 support.

VirusTotal analysis shows that two of ninety‑five security vendors have flagged the domain, and it appears on one external blocklist. The domain has been explicitly blocked by the PhishDestroy mitigation service and is currently reported as offline. These observable indicators—registrar metadata, Cloudflare infrastructure, TLS certificate, HTTP response, and limited vendor detections—confirm that the domain has been used in a generic phishing campaign, though no payload or landing page content is available for further verification.

Uncertainty remains regarding the specific phishing content, target brand, and active malicious infrastructure because the site returns only a not‑found page. Defenders should continue to block the domain at network perimeter and DNS filtering layers, monitor for any resurgence of the IP address or associated Cloudflare nameservers, and incorporate the domain into threat‑intel feeds. Ongoing observation of VirusTotal and other reputation services is advised to capture any future detections that may reveal additional malicious activity.