suport-metmskki[.]webflow[.]io

The domain suport-metmskki.webflow.io was observed resolving to the Cloudflare‑owned address 104.18.36.248, which is advertised as part of AS13335 Cloudflare, Inc. in the United States. The site presented a standard Google Trust Services / WE1 TLS certificate, indicating the certificate was issued by a trusted root but does not imply legitimacy of the underlying content. HTTP traffic was served over Cloudflare’s edge network with HTTP/3 enabled, and the page returned a 404 status code with the title "404 - Page not found" before being taken offline. Registration data shows the domain was created on May 08, 2013 and is managed through MarkMonitor, Inc., using the nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com.

The domain appears on one security blocklist and has been flagged by PhishDestroy. VirusTotal analysis recorded 14 detections out of 95 scanners, suggesting that a minority of security engines recognize it as malicious. No additional intelligence such as a targeted brand, phishing kit, or payload has been disclosed, leaving the exact impersonation intent uncertain.

Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the subdomain, and consider adding the IP address 104.18.36.248 to threat‑intel feeds if not already present. Since the TLS certificate is valid, reliance on certificate trust alone is insufficient; correlation with the observed 404 response, blocklist presence, and VirusTotal detections should guide automated blocking rules. Continuous re‑evaluation is advised in case the infrastructure is repurposed for future campaigns.