weatherbot[.]finance

The domain weatherbot.finance is currently active and is classified as a generic phishing site. The site returns an HTTP 301 redirect and displays the page title “Just a moment…”. Its TLS certificate is issued by Let’s Encrypt (identifier YE1), indicating the use of a free certificate authority. Registration was performed through Tucows Domains Inc., and the authoritative nameservers are 1-you.njalla.no, 2-can.njalla.in, and 3-get.njalla.fo, which are associated with the Njalla privacy‑focused hosting service. DNS resolution points to IP address 95.215.19.22, which is hosted in Sweden and attributed to Materialism s.r.l. The domain appears on three public blocklists and is flagged by PhishDestroy, MetaMask, and SEAL. AlienVault OTX lists the domain in two threat‑intel pulses, confirming prior observation by the security community. VirusTotal has processed the domain with 91 antivirus engines, yet no detections have been logged; this absence does not confirm safety. No further content analysis is available beyond the observed title, so the exact phishing payload or targeted brand remains unknown. Defenders should add weatherbot.finance to URL filtering and DNS sinkhole rules, monitor for any future payload changes, and consider sharing these indicators with upstream blocklist operators. Continuous observation is advised to detect possible evolution of the phishing campaign.