mhatre-doc4758839222-spreadsheet[.]weebly[.]com

The domain mhatre-doc4758839222-spreadsheet.weebly.com was identified on July 23, 2026 as a credential phishing site. The page title observed during the brief crawl was "Continue sign in to your account," a phrasing commonly used to lure victims into submitting login credentials. The site is hosted on the Weebly infrastructure (AS27647) and resolves to the IPv4 address 74.115.51.8, which is registered to a US location. DNS resolution is provided by four Amazon Route 53 name servers (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns). The certificate presented is a Let’s Encrypt certificate (issued by the E8 authority), confirming that HTTPS was active at the time of analysis.

A technical scan on VirusTotal recorded 14 detections out of 95 antivirus engines, indicating moderate confidence in malicious behavior. The domain appears on one external blocklist and is actively blocked by PhishDestroy, confirming that threat‑intelligence feeds have already flagged it. The site returned an HTTP 404 status, suggesting the malicious page may have been removed or is otherwise inaccessible, and the current operational status is listed as offline. Metadata shows the domain was originally registered on March 29, 2006 through Safenames Ltd, which predates the phishing activity and indicates possible reuse of an older registration. Cloudflare technology was detected, implying a CDN layer that could have been leveraged to obscure the origin of the malicious content.

While the page content could not be retrieved for deeper analysis, the combination of the credential‑oriented page title, the detection count, and the blocklist entries provide sufficient evidence to classify the domain as a credential phishing vector. Defenders should continue to block the domain and its resolving IP at perimeter and DNS layers, monitor for any re‑activation, and update automated URL filtering rules to include the observed page title pattern.