96664444324410000909987[.]weebly[.]com

The domain 96664444324410000909987.weebly.com was observed by multiple security services as a credential‑phishing site targeting Yahoo accounts. The site was created on 29 March 2006 and is registered through Safenames Ltd. It resolves to the IP address 74.115.51.8, which belongs to ASN 27647 (Weebly, Inc.) in the United States. DNS resolution is handled by four AWS Route 53 name servers (ns‑123.awsdns‑15.com, ns‑1500.awsdns‑59.org, ns‑1797.awsdns‑32.co.uk, ns‑646.awsdns). The web server presents a Let’s Encrypt certificate (issuer E8) and is fronted by Cloudflare. An HTTP request returns a 404 status and the page title reported is “Home”, indicating that the original phishing landing page has been removed.

The domain appears on one public blocklist and is listed by PhishDestroy as a malicious entry. Scamadviser assigns a trust score of 1 / 100, reflecting extreme risk. VirusTotal analysis shows that 15 of 95 scanned security vendors flagged the domain as malicious. The available intelligence classifies the activity as credential phishing that impersonates the Yahoo brand.

No additional artifacts such as login forms, tracking scripts, or payloads have been captured, so the exact content of the removed page remains unknown. Defenders should continue to block resolution of the domain at the DNS level, add the IP address 74.115.51.8 to network‑level deny lists, and ensure that web‑filtering solutions flag any URLs containing the domain as high‑risk. Continuous monitoring of the associated AWS name servers and the Weebly hosting infrastructure is advised, as the attacker could reactivate the site under the same infrastructure. Organizations should also educate users about unsolicited Yahoo login requests and encourage the use of multi‑factor authentication to mitigate credential‑theft attempts.