statement202613[.]weebly[.]com

On July 23 2026 analysts observed that the sub‑domain statement202613.weebly.com is currently offline but was previously serving a page titled “Sign in to your account”. The site was registered through Safenames Ltd and the domain creation date is recorded as 29 March 2006. DNS resolution points to the IP address 74.115.51.9, which belongs to AS27647 Weebly, Inc. in the United States. The hosting environment shows a combination of Weebly, Amazon Web Services, Cloudflare, MySQL, PHP, reCAPTCHA, jQuery and Google Analytics, indicating a typical SaaS‑based web builder stack. An SSL certificate labeled “YE1” was present on the host.

VirusTotal scans returned 20 detections out of 94 submitted scanners, confirming malicious classification by multiple vendors. The domain is listed on one public security blocklist and has been explicitly blocked by the PhishDestroy feed. The HTTP response returned a 404 status, suggesting the content was removed before the offline takedown. Nameserver records include ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk and ns-646.awsdns, all associated with Amazon’s DNS service.

The observed scam type is credential phishing, targeting user login credentials. While the exact phishing landing page cannot be inspected due to the 404 response, the combination of page title, malicious vendor detections, and blocklist presence provides sufficient confidence to treat the domain as a credential‑harvesting site. Defenders should add the domain and its resolving IP to network‑level deny lists, ensure that URL filtering solutions incorporate the observed blocklist entries, and monitor for any resurgence of the host under alternative sub‑domains. Continuous re‑scanning of the IP range and periodic checks of the registrar’s WHOIS data are recommended to detect potential re‑registration attempts.