hosterhosterhost[.]weebly[.]com

The domain hosterhosterhost.weebly.com was observed serving a page titled “Outlook Web App”. The site used a Let’s Encrypt certificate (E8) and responded with HTTP 404, indicating the expected resource was not found. Infrastructure analysis shows the host resolves to IP 74.115.51.8, which belongs to AS27647 (Weebly, Inc.) in the United States. DNS is managed by Cloudflare and the authoritative nameservers are ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, and ns-646.awsdns. The domain was registered on March 29, 2006 through Safenames Ltd. Current status is offline; the site has been taken down and is listed as “taken offline” in the feed.

Threat intelligence flags the domain as a Microsoft impersonation used for a tech‑support scam. VirusTotal scans returned 15 positive detections out of 95 vendors, and the domain appears on one external blocklist, with PhishDestroy confirming the malicious classification. The combination of a Microsoft‑related page title, brand‑targeted impersonation, and the tech‑support scam label suggests credential‑harvesting or remote‑access manipulation attempts, although the exact payload or phishing landing page could not be recovered because the site is no longer reachable. Uncertainties remain regarding the specific lures presented to victims, the duration of active exploitation, and whether additional infrastructure shares the same IP or hosting account.

Defenders should update URL filtering and DNS sinkhole rules to block hosterhosterhost.weebly.com and any subdomains under the same IP range. Network monitoring should flag outbound connections to 74.115.51.8 and alert on any user‑initiated TLS handshakes to the associated Let’s Encrypt certificate. Incident response teams should correlate internal logs for attempts to access “Outlook Web App” URLs and advise users to disregard unsolicited tech‑support calls referencing Microsoft services. Continuous monitoring of the registrar Safenames Ltd.