metemeskwalet[.]webflow[.]io

Analysis of the domain metemeskwalet.webflow.io indicates that it is currently active and resolves to the IP address 104.18.36.248. The domain was registered through Webflow, Inc., a legitimate website‑building platform, but the registrar information alone does not mitigate the observed malicious activity. VirusTotal records show that 7 out of 91 security vendors have flagged the domain, suggesting a non‑trivial detection rate across independent scanners.

The domain is listed on a single external security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, confirming that at least one commercial protection product has identified it as a phishing threat. DNS queries return NS_NOT_FOUND for nameservers, indicating that standard name server records are unavailable or have been deliberately obscured, a tactic commonly observed in abuse campaigns to hinder attribution. No public page title, SSL certificate details, or Safe Browsing verdicts are available in the current intelligence set, leaving the exact content and transport security characteristics of the site unverified.

The lack of additional contextual data such as OTX references or broader blocklist presence means that the full scope of the campaign cannot be precisely quantified at this time. Defenders should continue to block the domain at network perimeter controls, update URL filtering policies to include the observed IP address, and monitor for any future appearances of the domain in other threat intel feeds. Continuous re‑scanning with multi‑engine services is advised to capture any changes in the domain’s behavior or detection profile.