rafgh-105035[.]weeblysite[.]com

This domain, rafgh-105035.weeblysite.com, is identified as a credential phishing endpoint targeting users through deceptive landing pages. The site masquerades under the title 'Home | RAFGH,' suggesting an attempt to impersonate a legitimate entity or project, though no direct brand association has been confirmed. No specific phishing kit signatures were detected in initial scans, but the generic_phishing classification indicates the use of common credential-harvesting techniques, likely involving fake login portals or fraudulent data submission forms. Infrastructure analysis reveals the domain was registered through MarkMonitor Inc. on April 19, 2026, an unusual future date that may indicate domain spoofing or a registration system anomaly. The domain resolves to IP address 74.115.51.55, hosted by Weebly, Inc. in the United States. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious, with detection labels including credential phishing and social engineering. The domain appears on a single security blocklist and is currently blocked by PhishDestroy. SSL certificate analysis shows issuance by Google Trust Services under the 'WE1' intermediate, a common configuration for Weebly-hosted sites, which does not inherently indicate compromise but aligns with the hosting provider's standard deployment. As of the latest verification, the domain has been taken offline, reducing immediate exposure risk. However, residual threats persist due to potential cached DNS entries, browser history retention, or delayed blocklist propagation. Organizations should ensure endpoint protection systems are updated to recognize this domain and its associated IP. Network-level blocks should be implemented for 74.115.51.55, and users should be advised to verify any unexpected communications referencing 'RAFGH' or similar identifiers. Continuous monitoring is recommended, as threat actors may re-deploy the phishing infrastructure under a new domain or IP address.