999-884[.]weebly[.]com

Analysis of 999-884.weebly.com shows that the sub‑domain, created on March 29, 2006 and registered through Safenames Ltd, resolves to IP address 74.115.51.8, which belongs to the AS27647 Weebly, Inc. network in the United States. The site presented an HTTPS endpoint secured by a Let’s Encrypt certificate (E8 profile) and responded with an HTTP 404 status code at the time of observation, indicating that the landing page was not reachable. The page title returned by the server was "poczta onet - poczta onet", but no further content was captured.

Infrastructure fingerprints include Cloudflare as a detected technology and a set of four AWS Route 53 nameservers (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns). VirusTotal analysis recorded 15 detections out of 95 scanning engines, confirming malicious classification. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service.

Given the elevated risk rating, the combination of multiple vendor detections, the presence on a blocklist, and the use of a reputable hosting provider for phishing‑related content, defenders should treat the domain as hostile. Recommended actions include ensuring that perimeter firewalls, DNS filtering, and secure web gateways deny traffic to 74.115.51.8 and to the fully qualified domain name, updating intrusion detection signatures to incorporate the observed SSL fingerprint, and monitoring for any re‑activation attempts. Continuous observation of the registrar Safenames Ltd and the associated AWS name‑server set is advisable to detect future re‑registration or infrastructure changes.