# PhishDestroy domain threat record: dhjcf.weebly.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/dhjcf.weebly.com/
Machine-readable companion: https://phishdestroy.io/domain/dhjcf.weebly.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-11 17:06:28 UTC
- Last availability or vendor check: 2026-10-23 01:26:13 UTC
- Stored record updated: 2026-10-23 22:21:15 UTC
- VirusTotal detections in the stored snapshot: 17/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: telstra

## Stored infrastructure

- Observed IP address: 74.115.51.9
- Registrar in stored WHOIS data: Weebly
- Last stored HTTP status: 404
- Registration date (registry RDAP, weebly.com): 2006-03-29 00:25:07 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0908e-85c9-74e5-84c1-7b359be0609e/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/dhjcf.weebly.com
- Certificate Transparency search: https://crt.sh/?q=%25.dhjcf.weebly.com
- Web Archive lookup: https://web.archive.org/web/*/https://dhjcf.weebly.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
dhjcf.weebly.com is a phishing page that posed as Telstra, Australia's largest telecom provider. It was titled simply "Telstra" and was aimed at the carrier's mobile, broadband and billing customers. PhishDestroy first flagged it on 2026-09-11. The site has been offline since 2026-09-21, and a recheck on 2026-10-19 found nothing left at the root.

How the scam works
Telstra-themed phishing usually starts with a text or email about an unpaid bill, a suspended service or a refund, and links the victim to a page that looks like Telstra's sign-in or payment screen. Anything typed there goes to the operator, not to Telstra. That can include the My Telstra login, card numbers or personal identity details. A stolen telco login is especially dangerous because it can be used to take over the account, port the phone number or intercept SMS one-time codes for other services.

Evidence
Seventeen of 89 VirusTotal engines flagged the page as of 2026-09-20. Those engines include BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, G-Data, Emsisoft, Ermes and alphaMountain.ai. Agreement across that many independent vendors is strong for a short-lived page on a shared platform. urlscan.io returned a malicious verdict and its brand detection recognised Telstra on the page, which matches our classification. The site is listed on the PhishDestroy blocklist.

Infrastructure
The page was a free subdomain on the Weebly site builder, not a domain the operator registered. The 2006-03-29 registration date and the Weebly registrar both belong to the platform itself. Hosting sat on Weebly's own US network, and the Let's Encrypt certificate is the standard one Weebly issues to every site. The padlock therefore said nothing about legitimacy. Free builders like this let phishers launch quickly behind a trusted parent domain, which explains the roughly ten-day lifespan before the page went dark.

What to do
If you entered your Telstra login on this page, change that password immediately through Telstra's official app or website. Also change it on any other service where you reused it, and turn on two-factor authentication. If you gave card details, call your bank to cancel the card and dispute any charges you don't recognise. Ask Telstra to add a port-out or account PIN, and watch for sudden loss of mobile signal, which can signal a SIM swap. Defenders should block this specific subdomain rather than all of weebly.com, report future copies to Weebly's abuse team, and search mail and SMS logs for links to it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0908e-85c9-74e5-84c1-7b359be0609e/
VirusTotal report: https://www.virustotal.com/gui/domain/dhjcf.weebly.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=dhjcf.weebly.com
Archived copy: https://web.archive.org/web/20260917021621/https://dhjcf.weebly.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:19:36 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0908e-85c9-74e5-84c1-7b359be0609e.png
  Captured: 2026-09-12 08:11:11 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0908e-85c9-74e5-84c1-7b359be0609e.png
  Captured: 2026-09-12 08:11:11 UTC
  Source report: https://urlscan.io/result/01a0908e-85c9-74e5-84c1-7b359be0609e/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/58c7242d-95cc-4c74-b819-558bd3d91cc6.png
  Captured: 2026-09-11 17:11:06 UTC
  Source report: https://radar.cloudflare.com/scan/58c7242d-95cc-4c74-b819-558bd3d91cc6
  SHA-256: 38e9d6df28fda8f835066d004529bb1466ed1ddb4a0c6fcbfb76f4d42677cf35
- URLScan · 2026-09-10: https://screenshots.phishdestroy.io/us/01a08adc-08af-72a2-929c-4f3cd25ec710.png
  Captured: 2026-09-10 10:27:57 UTC
  Source report: https://urlscan.io/result/01a08adc-08af-72a2-929c-4f3cd25ec710/
  SHA-256: 817d124f2575facb3af0d64e8a7582b2add735dec64a933f7bf88a3df2d8d7ca
- URLScan · 2026-09-12: https://screenshots.phishdestroy.io/us/01a09323-17cb-753f-9c0b-004e08b0e7ad.png
  Captured: 2026-09-12 01:02:34 UTC
  Source report: https://urlscan.io/result/01a09323-17cb-753f-9c0b-004e08b0e7ad/
  SHA-256: f41d6849322b6561be5fa0228330f6ab4207f1594266ace660d00c0851a5e177
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a09d9e-67dc-771f-98a6-6110bfa63a04.png
  Captured: 2026-09-14 01:53:27 UTC
  Source report: https://urlscan.io/result/01a09d9e-67dc-771f-98a6-6110bfa63a04/
  SHA-256: 8da7535ba4dca6d930273e7b3cb14edec75bb8b47c99a62dead877d41e29d11e
- URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0a9ce-1229-77bd-869e-e50fbc3d53b2.png
  Captured: 2026-09-16 10:40:56 UTC
  Source report: https://urlscan.io/result/01a0a9ce-1229-77bd-869e-e50fbc3d53b2/
  SHA-256: 90c1abeb15b527ed8cc7f70c238a9343ce03cb2ba5e5cf05c59e14bc8c1d3377
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0bd84-1c8a-76fd-970c-4bd1b5dad1a6.png
  Captured: 2026-09-20 06:32:38 UTC
  Source report: https://urlscan.io/result/01a0bd84-1c8a-76fd-970c-4bd1b5dad1a6/
  SHA-256: 90c1abeb15b527ed8cc7f70c238a9343ce03cb2ba5e5cf05c59e14bc8c1d3377
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cea6-7336-7424-b50c-f1ebf98be441.png
  Captured: 2026-09-23 14:23:39 UTC
  Source report: https://urlscan.io/result/01a0cea6-7336-7424-b50c-f1ebf98be441/
  SHA-256: 5992e51d581cd82b089f5016e674b8596ebe80ddc53d58eb97d77e6d9ff5aea5

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:18:52Z",
        "uuid": "01a0908e-85c9-74e5-84c1-7b359be0609e",
        "scanned_at": "2026-09-11T13:01:01Z",
        "final_url": "https://dhjcf.weebly.com/",
        "status": 200,
        "ip": "74.115.51.9",
        "ptr": "wildcard.weebly.com",
        "domains": [
            "cdn2.editmysite.com",
            "cdn11.editmysite.com",
            "ec.editmysite.com",
            "www.gstatic.com",
            "www.google.com",
            "cdn3.editmysite.com",
            "ssl.google-analytics.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "2a00:1450:4001:c25::5e",
            "52.88.255.80",
            "2001:4860:482c:7700::",
            "2a00:1450:4001:c25::61",
            "2a04:4e42:600::302",
            "2a04:4e42::302",
            "2a00:1450:4001:c0f::5f",
            "74.115.51.9"
        ],
        "asns": [
            "15169",
            "16509",
            "54113",
            "27647"
        ],
        "countries": [
            "DE",
            "US"
        ],
        "doc_hash": "62ab47c01af2343195533bbf689ed72d6fbe2b2b61203a26c575926c9a90bb29",
        "script_hashes": [
            "397452d9f6a2ea6a2135b45c9e40139c68ac6661f3bab4413e7299586ccb408a",
            "5a630b41e7c3d34392bcb150a5731b6261bc6314d71d5db8407a646af15bf8af",
            "b6353ca52760aba4e7547ae9861db68158dc2af0f4febece55e5c775ee4449f5",
            "f75570c56743e8c705cb06f5f1f9b1f8f2cc13119f5e2acda2f3bb8d987de94a",
            "446f48f512ecc0b771af3c21a3036de3a1c5740d1e6bdbb61448834326d0c738",
            "c4cd233d3d6b0f184e99d5017e521b4c6f9106d3e546864a8ba516189b934311",
            "cfbf67a85c039719090cff2c4718de99203b1ced78cfb8fae5f7240d2f1570b7"
        ],
        "globals": [
            "Weebly",
            "STATIC_BASE",
            "ASSETS_BASE",
            "STYLE_PREFIX",
            "$",
            "jQuery",
            "_W",
            "publishedWBJP",
            "RECAPTCHA_PUBLIC_KEY",
            "INVISIBLE_RECAPTCHA_PUBLIC_KEY",
            "_",
            "Mustache",
            "jQBrowser",
            "PlatformElement",
            "whenThemeCSSLoaded",
            "isThemeCSSLoaded",
            "blogCommentDisplayForm",
            "YTPlayer",
            "VimeoPlayer",
            "Sd",
            "Rd",
            "Cd",
            "videojs",
            "_V_",
            "jsonrpc",
            "getCartCount",
            "getCartNavElement",
            "reportCartNavElement",
            "initPublishedFlyoutMenus",
            "flyoutMenusRefreshable",
            "initEditorFlyoutMenus",
            "refreshNavCondense",
            "disableFlyouts",
            "FlyoutMenu",
            "objectify",
            "mejs",
            "MediaElement",
            "MediaElementPlayer",
            "require",
            "platformElementRequire"
        ],
        "cookies": [
            "__cf_bm",
            "_snow_ses.33a4",
            "_snow_id.33a4",
            "sp"
        ],
        "storage_keys": [
            "modernizr",
            "snowplowOutQueue_snowday__wn_post2"
        ],
        "tls": {
            "san": [
                "*.weebly.com",
                "weebly.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "weebly.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-06T20:20:53Z",
            "valid_from": "2026-08-08T20:20:54Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 4917,
        "tls_age_days": 33,
        "tls_valid_days": 89,
        "requests": 38,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "telstra"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Telstra"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:31:52Z",
        "uuid": "58c7242d-95cc-4c74-b819-558bd3d91cc6",
        "scanned_at": "2026-09-11T17:11:06Z",
        "final_url": "https://dhjcf.weebly.com/",
        "status": 200,
        "history": [
            {
                "url": "https://dhjcf.weebly.com/",
                "status": 200
            }
        ],
        "dom_hash": "a7c7f17cf3b540afe98a278e64c0cb05bfea92522b02ced52253d7b65f390330",
        "doc_hash": "b8fd0b88369679265c6040f783db5eff2fba0f2555843910f1e93c6bf4a16931",
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "dhjcf.weebly.com",
                "type": "A",
                "value": "74.115.51.9"
            },
            {
                "name": "dhjcf.weebly.com",
                "type": "A",
                "value": "74.115.51.8"
            }
        ],
        "dnssec_valid": false,
        "ip": "74.115.51.9",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2006-03-29T00:25:07Z",
            "updated": "2026-08-10T19:04:53Z",
            "expires": "2032-03-28T23:25:07Z",
            "nameservers": [
                "ns-123.awsdns-15.com",
                "ns-1500.awsdns-59.org",
                "ns-1797.awsdns-32.co.uk",
                "ns-646.awsdns-16.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T16:21:19Z",
        "analysis_at": "2026-10-12T11:29:05Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 16,
            "suspicious": 1,
            "undetected": 29
        },
        "detections": {
            "ESET": "phishing",
            "Ermes": "phishing",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "URLQuery": "malicious",
            "Kaspersky": "phishing",
            "LevelBlue": "suspicious",
            "Gridinsoft": "phishing",
            "MalwareURL": "phishing",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "created": "2006-03-29T00:00:00Z",
        "updated": "2026-03-30T00:00:00Z",
        "first_seen": "2026-09-10T11:10:54Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "A",
                "value": "74.115.51.8"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "74.115.51.9"
            }
        ],
        "dns_at": "2026-10-12T11:29:19Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "*.weebly.com",
                "weebly.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "537be20737256ed93d00e736e0c91ccf99d",
            "sha256": "0ab63db1f470cfa51bc6372a78a47a8db5f315e8e14c970970e78d8f6ccd9281",
            "subject": "weebly.com",
            "valid_to": "2027-01-04T19:46:47Z",
            "valid_from": "2026-10-06T19:46:48Z"
        },
        "whois": []
    }
}
```