hghtutc[.]weebly[.]com

Analysis of hghtutc.weebly.com shows a recently created domain (registered on February 21, 2026) that has been taken offline and now returns HTTP 404 for the sole page titled “Home.” The site was hosted on Weebly’s infrastructure (AS27647, United States) and resolved to IP 74.115.51.9, which is consistent with Weebly’s shared hosting pool. DNS resolution used four Amazon Route 53 name servers (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns), indicating typical cloud‑based DNS services. The TLS certificate presented was issued by Let’s Encrypt (E8), a free certificate authority, and the site also employed Cloudflare technology, a common layer‑7 proxy used for performance and security. Security‑vendor intelligence flagged the domain on 19 of 93 VirusTotal scanners, and it appears on a single external blocklist.

PhishDestroy has explicitly blocked the domain, reinforcing the classification of the site as a phishing‑related resource. Registration was performed through Squarespace Domains II LLC, a registrar that often services short‑lived or disposable sites. While the page title “Home” provides no insight into the intended victim‑target or lure, the combination of a fresh domain, free SSL, cloud‑based hosting, and multiple vendor detections aligns with typical phishing infrastructure.

Uncertainties remain regarding the specific credential‑harvesting tactics, the brand or service being impersonated, and whether any active payloads were ever served before the site went offline. Defenders should continue to block the domain at perimeter and DNS filters, monitor the associated IP address for any re‑use, and consider adding the domain to internal threat‑intel feeds. Ongoing vigilance is advised, especially if the domain reappears under a different sub‑domain or hosting configuration, as threat actors frequently recycle compromised hosting assets.