odstranit[.]weebly[.]com

This domain, odstranit.weebly.com, is flagged for hosting a credential theft operation targeting users through a Spanish-language phishing page. The page title, CONFIRMA TU CUENTA, suggests an attempt to impersonate a legitimate account verification process, likely targeting financial or email service credentials. Analysis indicates no direct association with known crypto drainer kits or brand-specific impersonation (e.g., banking, social media), but the generic yet localized approach increases the likelihood of broad targeting across multiple sectors.

Infrastructure analysis reveals the following technical indicators: the domain resolves to IP 74.115.51.9, hosted by Weebly, Inc. in the United States. It was registered on April 28, 2026, through MarkMonitor, Inc., and uses a Let's Encrypt SSL certificate (serial number E8). Detection metrics include a VirusTotal score of 18/95 security vendors flagging the domain, and it appears on one security blocklist. Google Safe Browsing (GSB) status is not explicitly provided, but the domain is currently offline, likely due to takedown efforts.

The domain has been taken offline, mitigating immediate user risk. However, residual threats persist, including potential reuse of the infrastructure or migration of the phishing campaign to alternative domains. Users who may have interacted with the page should reset credentials for any accounts entered, enable multi-factor authentication (MFA), and monitor for unauthorized activity. Organizations should update blocklists to include the domain and associated IP, while security teams should investigate potential lateral movement or follow-up attacks leveraging stolen credentials. The elevated risk level is justified by the domain's detection history and the scalable nature of credential theft campaigns.