eng-metmskks-web[.]netlify[.]app

The domain eng-metmskks-web.netlify.app was observed hosting a generic phishing page that returned a 404 response with the title “Site not found”. DNS resolution points to the IPv4 address 98.84.224.111, which is allocated to Amazon.com, Inc. (AS14618) and geolocated to the United States. The site was deployed on Netlify, as indicated by the Netlify technology fingerprint and the presence of HTTP Strict Transport Security (HSTS) headers. The TLS certificate presented by the host is issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 and is signed by DigiCert Inc., confirming the use of a valid public‑trusted certificate chain.

Google Safe Browsing classifies the domain as “social engineering”, and the domain appears on a single security blocklist that has already taken it offline. It is also listed by the PhishDestroy blocklist, confirming that active mitigation has been applied. VirusTotal scans show that 14 of 95 antivirus and URL‑reputation engines flagged the domain, reinforcing the malicious assessment. Registrar information shows the site was created through Netlify’s hosting service; the nameserver query returned NS_NOT_FOUND, indicating that standard authoritative name servers are not exposed.

The HTTP status code 404 and the “Site not found” page title suggest that the malicious content has been removed or the site has been deliberately taken down. Given the combination of a known phishing classification, a malicious blocklist presence, multiple vendor detections, and the use of a reputable TLS certificate to lend credibility, defenders should continue to block the domain at network perimeters and endpoint filters. Monitoring of the associated IP address 98.84.224.111 for any resurgence of malicious activity is advisable, as the hosting provider may be reused for future campaigns. Incident response teams should also update any URL reputation feeds with the current findings to ensure rapid detection of repeat attempts.