comxfi05st[.]weebly[.]com

This domain, comxfi05st.weebly.com, operates as a credential harvesting phishing site targeting users with a fraudulent login interface. The page title, 'Sign in,' mimics legitimate authentication portals, increasing the likelihood of user deception. Analysis indicates the domain is designed to capture entered credentials, which may be exploited for unauthorized account access, financial fraud, or further phishing campaigns. The threat primarily targets individuals unaware of the domain's malicious intent, leveraging social engineering to bypass security awareness.

Infrastructure analysis reveals the domain was registered on March 29, 2006, through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains. As of the latest scan, 14 out of 95 security vendors on VirusTotal flag the domain as malicious, with Google Safe Browsing specifically classifying it as a phishing threat. The domain resolves to the IP address 74.115.51.8, which may serve as an additional indicator for network-level blocking. Despite its long registration history, the domain remains active, suggesting ongoing malicious activity.

Users who have visited comxfi05st.weebly.com and entered credentials are advised to take immediate action. First, reset passwords for any accounts accessed while on the site, prioritizing email, financial, and administrative accounts. Enable multi-factor authentication (MFA) where available to mitigate unauthorized access. Monitor linked accounts for suspicious activity, such as unauthorized logins or transactions. If financial information was entered, contact relevant institutions to flag potential fraud. Network administrators should block the domain and its resolving IP (74.115.51.8) at the firewall or proxy level to prevent further exposure. Report the domain to security teams for inclusion in threat intelligence feeds.