xersde4rjnms[.]weebly[.]com

Analysis of xersde4rjnms.weebly.com shows a credential‑phishing infrastructure targeting the Juno brand, as indicated by the page title "My Juno Login Screen - Home." The domain resolves to 74.115.51.8, an IP owned by the Weebly hosting network (AS27647) in the United States. DNS is served by four AWS name servers (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns). The site employs a Let's Encrypt E8 TLS certificate, MySQL, PHP, reCAPTCHA, jQuery, Google Hosted Libraries, and Google Analytics, confirming a typical Weebly‑based deployment. HTTP responses return a 403 status, suggesting that the phishing page may be conditionally served. Reputation data is adverse: Gridinsoft assigns a trust score of 0 / 100, VirusTotal records 16 detections out of 95 scanners, and the domain appears on two public blocklists (PhishDestroy, PhishingDB). Registration data shows creation on 29 Mar 2006 via Safenames Ltd. While the exact visual content has not been disclosed, the available indicators confirm a high‑risk, active phishing operation. Defenders should block the domain at DNS and proxy layers, add the IP to threat‑intel feeds, monitor for additional subdomains under the same name‑server set, and educate users to verify the legitimacy of Juno login URLs before credential entry.