microsoftj3ewywo4es[.]weebly[.]com

Analysis of the domain microsoftj3ewywo4es.weebly.com, first observed on February 21, 2026, indicates a brand‑impersonation campaign targeting Microsoft users through a tech‑support scam. The site was hosted on the Weebly platform, as reflected by the IP address 74.115.51.9 which belongs to AS27647 (Weebly, Inc.) in the United States. DNS resolution employed four AWS name servers (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns), a pattern frequently associated with fast‑deployment infrastructure. The TLS certificate was issued by Let’s Encrypt (certificate identifier E8), providing a valid HTTPS endpoint but offering no assurance of legitimacy. A Cloudflare technology fingerprint was detected, suggesting the use of a CDN or security service to mask origin details.

The page returned an HTTP 404 status and displayed the title “Home”, indicating that the malicious landing page is no longer accessible. The domain has been taken offline, and the phishing‑related URL was blocked by the PhishDestroy blocklist, appearing on one additional security blocklist. VirusTotal scans recorded 13 detections out of 93 scanned vendors, reinforcing the suspicion of malicious intent. The registrar listed as Squarespace Domains II LLC aligns with the Weebly hosting environment.

Defenders should continue to block the resolved IP 74.115.51.9 at the network perimeter and add the fully qualified domain name to URL filtering policies. Monitoring of the associated AWS name servers is advisable, as they may be reused for future campaigns. Although the content is currently unavailable, the historical evidence of tech‑support impersonation of Microsoft warrants heightened vigilance for similar domains employing Weebly or Squarespace infrastructure. Ongoing threat‑intel feeds should be consulted for any resurgence of the domain or related indicators.