lopeqboss[.]weebly[.]com

The domain lopeqboss.weebly.com has been flagged by PhishDestroy as hosting a credential theft phishing page impersonating a well-known service provider. The site leverages a Weebly-hosted subdomain to disguise its malicious nature while harvesting user credentials. Evidence suggests the threat actor is using a generic credential theft kit rather than a specialized crypto drainer, indicating a focus on harvesting login credentials from unsuspecting users.

Technical indicators confirm the domain's malicious intent: VirusTotal currently shows 0/95 antivirus detections, suggesting limited detection by traditional security engines. The domain is registered through MarkMonitor, Inc., a known registrar frequently utilized for both legitimate and malicious purposes. It resolves to IP address 74.115.51.9, which has no publicly documented association with legitimate Weebly services. The domain was created on March 29, 2006, which may indicate either a compromised legitimate domain or deliberate long-term registration to build trust. The SSL certificate is issued by Let's Encrypt, adding an unnecessary but deceptive layer of legitimacy. Public blocklist checks reveal this domain is currently unlisted on major blocklists including Google Safe Browsing.

As of current analysis, lopeqboss.weebly.com remains active with a high-risk status. PhishDestroy identifies no active takedown efforts from hosting providers or registrars at this time. Users are advised to avoid interacting with any login prompts or input fields on this domain. Security teams should block the domain at network and endpoint levels immediately. Remaining risk is assessed as critical due to the active credential theft operation and lack of detection. Continuous monitoring and collaborative threat intelligence sharing are recommended to prevent credential harvesting campaigns from expanding. Seed:75704f