gmxnetdedienst[.]weebly[.]com

The domain gmxnetdedienst.weebly.com was registered on February 21, 2026 through Squarespace Domains II LLC and currently resolves to the IP address 74.115.51.8, which belongs to AS27647 Weebly, Inc. in the United States. The site presents an HTTP 200 response and serves a TLS certificate issued by Let’s Encrypt (certificate identifier E8). The only visible page element is the title “Just a moment…”, and no additional content has been publicly disclosed. Technical fingerprinting shows the presence of Weebly, MySQL, PHP, Amazon Web Services, reCAPTCHA, jQuery, Google Analytics, and Cloudflare, indicating a typical web‑hosting stack used for disposable pages.

Security reputation data is concerning: VirusTotal records 19 detections out of 91 scanning engines, a Gridinsoft trust score of 0 / 100, and the domain appears on one known blocklist. It is also listed as blocked by PhishDestroy. The authoritative name servers are ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, and ns-646.awsdns, all belonging to Amazon’s DNS service. Current status is active, and the infrastructure remains unchanged.

While the exact phishing payload or targeted brand is not observable from the available evidence, the combination of a low trust score, multiple vendor detections, and inclusion on phishing‑specific blocklists classifies the site as a high‑risk phishing infrastructure. Defenders should immediately block the domain and its resolving IP at perimeter defenses, add the name servers to monitoring lists, and continue periodic re‑resolution checks. Additional analysis of the site’s underlying pages, when possible, is recommended to confirm the lure vector and to update detection signatures accordingly.