api[.]meedoobestkeyplati[.]com

api.meedoobestkeyplati.com was observed delivering a generic phishing payload and is currently offline. The domain resolves to 188.114.97.3, an address owned by Cloudflare (AS13335) located in the United States. DNS resolution is served by kirk.ns.cloudflare.com and magdalena.ns.cloudflare.com, confirming Cloudflare infrastructure. The site presented the HTTP status 521 (“Web server is down”) and the page title “meedoobestkeyplati.com | 521: Web server is down”.

TLS termination is handled by a Google Trust Services certificate issued to WE1, indicating a valid public‑trusted certificate chain. VirusTotal has recorded 12 positive detections out of 93 scanned scanners, and the domain appears on a single external blocklist. PhishDestroy has already added the domain to its blocklist, providing an additional mitigation source. Registration data shows the domain was created on 21 February 2026 via NameCheap, Inc., suggesting a short‑lived registration typical of malicious campaigns.

The limited detection footprint—only one blocklist and a modest VirusTotal hit count—means that broader intelligence feeds may not yet reference the domain. Defenders should continue to block the IP address 188.114.97.3 at network perimeter devices, enforce DNS filtering for the domain, and add the domain to internal blacklists. Monitoring for any re‑hosting of the same hostnames on alternative IP ranges or for new sub‑domains under the same registrar is advised. Given the active blocklist entry and the presence of a valid SSL certificate, automated TLS inspection may be required to surface any encrypted payloads should the site become active again.