verifcaci0n-b4nco-p1chincha-25[.]weebly[.]com

Analysis of the domain verifcaci0n-b4nco-p1chincha-25.weebly.com indicates it was actively used in a phishing campaign targeting financial institution customers. The domain, registered through Safenames Ltd. on March 29, 2006, resolves to the IP address 185.27.134.252, hosted under AS34119 (Wildcard UK Limited) in the United Kingdom. Infrastructure analysis reveals the use of Weebly as the hosting platform, alongside detected technologies including MySQL, PHP, Apache Traffic Server, jQuery, and HTTP/3, suggesting a structured phishing framework. The SSL certificate is issued by Let's Encrypt (E8), a common choice for both legitimate and malicious sites. The page title 'Verificacion' aligns with phishing tactics designed to deceive users into submitting sensitive information under the guise of account verification.

At the time of assessment, the domain was flagged by 15 of 93 security vendors on VirusTotal and appeared on one security blocklist, indicating elevated risk. The domain has since been taken offline, returning an HTTP 404 status. Detection by PhishDestroy further corroborates its classification as a phishing threat. Defenders should treat this domain as part of a broader campaign impersonating financial services. The use of Weebly, a legitimate website builder, complicates automated detection, as the platform is frequently abused for phishing due to its accessibility and free hosting options.

The nameservers (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns) are associated with Amazon Web Services, a common infrastructure provider for both benign and malicious content. While the exact brand being impersonated is not explicitly confirmed in the available data, the domain name structure ('b4nco-p1chincha') suggests an attempt to mimic a banking institution. The content of the phishing page itself has not been fully analyzed, so specific lures or data collection methods remain unconfirmed.