webde-106891[.]weeblysite[.]com

Analysis of the domain webde-106891.weeblysite.com indicates it was actively impersonating Web.de, a German email and online services provider, as of July 24, 2026. The domain, registered through Safenames Ltd on December 19, 2012, resolved to the IP address 74.115.51.54, hosted on Weebly, Inc.'s infrastructure (AS27647) in the United States. The page title, 'Home | WEB.DE,' directly matches the branding of the legitimate Web.de platform, reinforcing the likelihood of brand impersonation. Infrastructure analysis reveals the use of Amazon Web Services for hosting, with nameservers ns-1375.awsdns-43.org, ns-1854.awsdns-39.co.uk, ns-510.awsdns-63.com, and ns-522.awsdns, alongside Cloudflare for additional network services. At the time of reporting, the domain returned an HTTP 404 status, suggesting it had been taken offline or disabled.

However, prior to its removal, 14 of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on at least one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), does not inherently indicate malicious activity but is consistent with phishing domains leveraging legitimate certificate authorities to appear trustworthy. The domain's creation date predates its use in this campaign, which is not uncommon for repurposed or dormant domains exploited for phishing. Defenders should treat this domain as part of a brand impersonation campaign targeting Web.de users.

While the domain is currently offline, historical DNS and hosting data should be preserved for forensic analysis. Organizations are advised to monitor for similar domains using Weebly or AWS infrastructure, particularly those mimicking Web.de branding. If this domain was previously accessed within a network, incident response procedures should be initiated to assess potential credential exposure or malware delivery.