fhhhggrhrhrseriiivcevsercvicmsyp[.]weebly[.]com

This domain is flagged for elevated-risk brand impersonation targeting Telstra, specifically designed to mimic the company’s webmail interface for credential harvesting. Analysis of the page title, Telstra - Inbox - Mail - Webmail, confirms the intent to deceive users into entering sensitive login details under the guise of a legitimate communication portal. The threat type is classified as credential phishing with a focus on corporate or personal email compromise, a tactic commonly used to facilitate further fraudulent activities such as unauthorized access, data exfiltration, or financial fraud. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was registered through Squarespace Domains II LLC on February 21, 2026, and currently resolves to the IP address 74.115.51.9, hosted on autonomous system AS27647 (Weebly, Inc.) in the United States. The SSL certificate is issued by Let’s Encrypt (serial E8), a common choice for both legitimate and malicious sites due to its free and automated issuance process. The domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal detection metrics show 18 out of 95 security vendors flagging the domain as malicious, with a focus on phishing-related threats. The combination of a recently created domain, low detection but targeted blocklisting, and hosting on a platform known for abuse underscores the calculated nature of this campaign. Mitigation steps should prioritize both technical and user-focused controls to disrupt the phishing operation and prevent credential compromise. Network-level blocking of the domain and its resolving IP (74.115.51.9) is recommended, along with monitoring for any attempts to access the domain from internal systems. Security teams should review logs for connections to the IP or domain, particularly from endpoints exhibiting anomalous behavior such as unexpected authentication attempts or data transfers. User awareness training should emphasize the risks of webmail impersonation, including the verification of domain authenticity and the use of multi-factor authentication (MFA) for all corporate and personal email accounts. Additionally, organizations should implement email filtering rules to quarantine or flag messages containing links to domains hosted on Weebly or other free website builders, as these platforms are frequently abused for phishing campaigns. Proactive monitoring for similar domains, particularly those using random character strings or slight variations of the target brand name, can help identify and neutralize emerging threats before they gain traction.