xires[.]weebly[.]com

The domain xires.weebly.com has been identified as a phishing resource specializing in brand impersonation, specifically targeting GMX, a widely used email service provider. Analysis confirms the domain was designed to mimic the legitimate GMX.DE login interface, aiming to harvest user credentials through deceptive means. As of the latest assessment, the domain has been taken offline, though prior activity indicates a deliberate attempt to exploit trust in the GMX brand. Infrastructure analysis reveals the domain was flagged by 20 of 95 security vendors on VirusTotal, a notable detection rate that underscores its malicious intent. It was registered through Safenames Ltd and resolved to the IP address 74.115.51.9, hosted by Weebly, Inc. in the United States. The domain was created on March 29, 2026, though this date may reflect registry manipulation or backdating to evade scrutiny. It appeared on a single security blocklist, suggesting limited but targeted distribution. The SSL certificate was issued by Let’s Encrypt (serial number E8), a common choice among threat actors due to its accessibility and short-lived validity periods. Current status indicates the domain is offline, reducing immediate risk to end users. However, the infrastructure and tactics observed align with broader phishing campaigns that recycle domains or shift to new hosts. Organizations and individuals are advised to monitor for similar impersonation attempts, particularly those leveraging free hosting platforms or Let’s Encrypt certificates. Network defenders should update blocklists to include the IP 74.115.51.9 and any associated subdomains. Users who may have interacted with the domain should reset credentials for GMX or other sensitive accounts and enable multi-factor authentication where available. Proactive monitoring of domain registrations tied to known registrars, such as Safenames Ltd, may aid in early detection of future threats.