edward-russell-2026[.]weebly[.]com

Analysis conducted on July 23, 2026 identifies edward-russell-2026.weebly.com as a credential‑phishing site that has been taken offline. The domain was registered on March 11, 2026 through Safenames Ltd and resolves to the IP address 74.115.51.9, which belongs to AS27647 (Weebly, Inc.) in the United States. DNS resolution uses four Amazon Route 53 nameservers (ns‑123.awsdns‑15.com, ns‑1500.awsdns‑59.org, ns‑1797.awsdns‑32.co.uk, ns‑646.awsdns), indicating reliance on AWS infrastructure. The site served an HTTP 404 response and presented a TLS certificate issued by Let’s Encrypt (expiration tier E8), confirming that HTTPS was configured before the takedown.

Static analysis of the page metadata reveals the title “OFFICE – Sign In To Email”, consistent with a credential‑phishing lure targeting Office‑365 users. The technology fingerprint shows a Weebly‑based front end complemented by MySQL, PHP, reCAPTCHA, jQuery, Google Analytics and Cloudflare, typical of low‑cost site builders used by threat actors. Detection services have flagged the domain: 13 of 94 security vendors on VirusTotal reported it as malicious, and it appears on one public blocklist. PhishDestroy has actively blocked the domain, reinforcing the assessment of malicious intent.

Uncertainty remains regarding the full scope of the campaign because the site is no longer reachable and only a 404 status is observable. No additional payloads, credential‑harvesting forms, or redirect chains have been captured, limiting attribution of any exfiltrated data. Defenders should continue to monitor the associated IP address and the AWS nameservers for any re‑use of the infrastructure, add the domain and its IP to local blocklists, and ensure that email gateways enforce MFA and domain‑based message authentication for Office‑365 traffic. Ongoing threat‑intel feeds should be consulted for any resurgence of the same hosting profile.