gmx-login-web[.]weebly[.]com

The domain gmx-login-web.weebly.com was identified as a brand impersonation phishing site targeting GMX, a widely used email service provider. Analysis indicates the page presented a fraudulent login portal mimicking the legitimate gmx.de interface, designed to harvest user credentials. The domain is currently offline, though prior activity suggests it was actively used for malicious purposes. Technical indicators confirm the domain was registered on February 21, 2026, through Squarespace Domains II LLC, a registrar commonly associated with both legitimate and malicious registrations. It resolved to the IP address 74.115.51.8, hosted on infrastructure belonging to Weebly, Inc. (AS27647) in the United States. The site was flagged by 18 of 95 security vendors on VirusTotal, with detection signatures consistent with phishing activity. Additionally, the domain appeared on one security blocklist and was proactively blocked by at least one anti-phishing system. The SSL certificate was issued by Let's Encrypt, a common provider for both legitimate and malicious sites, which does not inherently indicate trustworthiness. Infrastructure analysis reveals the use of Weebly's subdomain hosting service, a platform frequently exploited for low-cost phishing deployments due to its accessibility and minimal verification requirements. The elevated risk level assigned to this domain stems from its direct impersonation of a trusted brand, high detection rate among security vendors, and prior operational status. Organizations and users are advised to treat any prior interactions with this domain as compromised. Network defenders should ensure the domain and associated IP (74.115.51.8) are blocked at the perimeter. Users who may have entered credentials on this site should immediately reset passwords for GMX and any other accounts where identical credentials were reused. Monitoring for unauthorized access or anomalous login attempts is strongly recommended.