ref0393933ee[.]weebly[.]com

This report details a credential phishing threat identified at the domain ref0393933ee.weebly.com. The site, titled "Log in," is designed to impersonate a legitimate login page to harvest user credentials. The threat is credential theft, where unsuspecting visitors may enter sensitive account information, which is then captured by the threat actor.

Technical evidence confirms the malicious nature of this domain. VirusTotal analysis shows 16 out of 95 security vendors flagged the site as malicious, with detections from ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, and CyRadar. The domain is registered under Squarespace Domains II LLC, hosted on IP address 74.115.51.8 (US, AS27647 Weebly, Inc.), and was created on 2026-02-21. It uses an SSL certificate from Let's Encrypt (E8) and nameservers ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, and ns-646.awsdns.

The domain is currently offline or down, indicating the threat may be inactive or blocked. The risk level is moderate due to confirmed phishing activity and multiple vendor detections, but the immediate threat is reduced by its current inaccessibility.