xxx565xx90-9[.]weebly[.]com

Analysis of xxx565xx90-9.weebly.com shows the site is active and operates a credential‑phishing campaign, as indicated by the page title “poczta onet – Home”. The domain was created on 4 March 2026 through Safenames Ltd and is hosted on infrastructure owned by Weebly, Inc. DNS resolution points to 74.115.51.8, located in the United States, and the domain uses the nameservers ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, and ns-646.awsdns. The site presents a valid TLS certificate (E8) and returns HTTP status 200. VirusTotal scans indicate that 19 of 94 security vendors have flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100. Technical fingerprints reveal a typical web‑stack including PHP, MySQL, jQuery, a CAPTCHA service, analytics tracking, and a content‑delivery network, consistent with a Weebly‑based hosting environment. The domain appears on one security blocklist and has been blocked by the PhishDestroy filtering service.

Uncertainty remains about the exact data exfiltrated from victims, the presence of any secondary malicious payloads, and whether additional infrastructure shares this hosting profile. No evidence of command‑and‑control servers or related domains has been observed. Defenders should block the domain at perimeter filters, enforce URL filtering that includes the listed nameservers and resolved IP address, and monitor for outbound connections to the identified IP. Incident response teams should treat any credentials submitted to the site as compromised, prompting immediate password resets for affected users. Ongoing intelligence collection should focus on identifying other domains registered through the same registrar or hosted on the same provider to anticipate future campaigns.