metskcromexttsion[.]webflow[.]io

The domain metskcromexttsion.webflow.io is currently offline but was previously identified as a generic phishing site. According to VirusTotal analysis, thirteen of ninety-five security vendors flagged the domain, indicating a moderate level of malicious confidence. The site was hosted behind Cloudflare infrastructure (AS13335) and resolved to IP address 104.18.36.248, which is geolocated to the United States. The SSL certificate presented by the service was issued by Google Trust Services under the WE1 designation, confirming the use of a valid TLS chain despite the malicious purpose.

Registration records show the domain was created on May 08, 2013 and is managed through MarkMonitor, Inc., with authoritative name servers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The HTTP response returned a 404 status code and the page title was "404 - Page not found," suggesting the phishing content has been removed or the site was taken down. The domain appears on a single security blocklist and has been blocked by the PhishDestroy feed, reinforcing its classification as a phishing vector. Defenders should continue to monitor outbound traffic for connections to 104.18.36.248 and enforce blocklisting of the domain across DNS filtering solutions.

Given the Cloudflare fronting, direct IP blocking may be insufficient; policy should target the fully qualified domain name. Organizations using web filtering should ensure that any cached or historic references to this domain are purged, and incident response teams should investigate any recent authentication attempts that may have involved this host. The combination of vendor detections, blocklist inclusion, and legitimate TLS issuance demonstrates a typical abuse of trusted infrastructure to lend credibility to phishing campaigns, and the domain should be treated as hostile until a formal takedown confirmation is received.