vvxx564[.]weebly[.]com

This domain, vvxx564.weebly.com, is identified as a phishing site impersonating the Onet webmail service, specifically targeting users of the legitimate poczta.onet.pl platform. The page title 'poczta onet - Home' directly mimics the authentic Onet login portal, designed to harvest credentials from unsuspecting users. Analysis indicates the site employs a fake login form to capture email addresses and passwords, which are then likely transmitted to threat actors for account compromise, spam distribution, or further malicious campaigns. The use of a free website builder platform and a generic page title suggests an attempt to lower development costs while maximizing reach through deceptive search engine optimization or phishing links distributed via email and social media. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on February 25, 2026, through Safenames Ltd, a registrar frequently observed in phishing operations due to its accessibility and privacy features. It resolves to the IP address 74.115.51.9, hosted on AS27647 (Weebly, Inc.) in the United States, a network segment commonly abused for hosting low-cost phishing sites. The domain is flagged by 17 out of 95 security vendors on VirusTotal, including detections for phishing and brand impersonation. Additionally, it appears on one security blocklist, specifically PhishDestroy, further corroborating its malicious classification. The site uses a Let's Encrypt SSL certificate (serial number E8), which, while providing encryption, does not validate the legitimacy of the content and is frequently exploited by threat actors to lend a false sense of security to victims. Users who visited vvxx564.weebly.com or entered credentials on the site should take immediate action to mitigate potential compromise. First, change the password for the Onet account and any other services where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor the affected email account for signs of unauthorized activity, such as sent messages, password reset emails, or unfamiliar login attempts. If financial or sensitive personal information was entered, consider placing a fraud alert on credit files and reviewing account statements for suspicious transactions. Organizations should update their email security filters to block the domain and its associated IP address, and educate users on recognizing phishing attempts, particularly those impersonating webmail services.