jnlfsnblfnblge[.]weebly[.]com

This domain, jnlfsnblfnblge.weebly.com, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. The site mimics legitimate authentication portals, employing social engineering tactics to capture usernames, passwords, and potentially multi-factor authentication codes. Infrastructure analysis reveals the domain leverages Weebly’s hosting services, a platform frequently abused for rapid deployment of phishing pages due to its ease of use and free tier availability. The page title "Home" suggests an attempt to appear as a generic or trusted landing page, a common tactic to lower user suspicion. Evidence supporting the phishing classification includes detection by 12 out of 95 security vendors on VirusTotal, indicating broad consensus among threat intelligence sources. The domain was registered through Safenames Ltd on March 29, 2006, though the specific subdomain (jnlfsnblfnblge) is likely a recent creation, as Weebly subdomains are dynamically generated and often short-lived. It resolves to the IP address 74.115.51.8, associated with Weebly, Inc. (AS27647) in the United States. The domain appears on one security blocklist and was proactively blocked by at least one enterprise-grade threat intelligence feed. The SSL certificate, issued by Let’s Encrypt (serial number E8), provides HTTPS encryption, which attackers exploit to lend false legitimacy to the phishing page. Users who visited jnlfsnblfnblfnblge.weebly.com should assume their credentials were compromised and take immediate remedial action. Change passwords for any accounts accessed or entered on the site, prioritizing financial, email, and work-related services. Enable multi-factor authentication (MFA) on all critical accounts, using app-based or hardware tokens rather than SMS-based methods. Monitor accounts for unauthorized activity, including login attempts, password reset emails, or unfamiliar transactions. If the same credentials were reused across multiple sites, update those as well to prevent credential-stuffing attacks. Report the incident to relevant security teams or fraud departments, particularly if corporate or financial accounts were involved. Organizations should consider implementing domain monitoring to detect similar phishing infrastructure leveraging Weebly or other free hosting platforms.