tundepay[.]weebly[.]com

Analysis of tundepay.weebly.com indicates that the domain was registered on February 28, 2026 through Safenames Ltd. and is hosted on the Weebly platform (AS27647, United States). DNS resolution points to IP address 74.115.51.9, which is owned by Weebly, Inc. The domain uses a Let's Encrypt certificate (E8) and is served behind Cloudflare, although the HTTP response returns a 404 status code and the page title is reported as "Home". Threat intelligence flags the site as a generic phishing vector and assigns an elevated risk rating. VirusTotal scans show that 16 of 93 security vendors have flagged the domain, demonstrating a moderate level of detection across the security community.

The domain is currently listed on PhishDestroy and appears on one additional security blocklist, confirming that active mitigation measures are in place. No Safe Browsing or OTX entries are disclosed in the available data. The site is presently offline, which may be the result of takedown actions or the operators disabling the infrastructure. Uncertainty remains regarding the specific credentials or brand that the phishing campaign attempts to emulate, as the page title and other visible artifacts do not reveal a target.

Defenders should continue to monitor the domain for any reactivation, enforce blocklist updates in web filters, and consider adding the IP address 74.115.51.9 to network deny lists where appropriate. Additional scrutiny of related Weebly-hosted subdomains and the associated nameservers (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns) is advised to detect possible campaign expansion. Organizations should educate users about unsolicited login prompts and verify the authenticity of URLs before entering credentials, especially when encountering sites that resolve to cloud‑based hosting providers but present generic page titles such as "Home".