tottalallianceemailsupport[.]weebly[.]com

This domain, tottalallianceemailsupport.weebly.com, is identified as a fake login portal designed to harvest corporate credentials. Analysis indicates the page mimics legitimate email support portals, likely targeting employees or clients of organizations with similar naming conventions. The intent is to deceive users into entering credentials, which are then exfiltrated to threat actors for unauthorized access to internal systems or further exploitation in business email compromise (BEC) schemes. Infrastructure analysis reveals the domain was created on March 29, 2006, though the phishing content appears to be a recent addition hosted on Weebly’s platform. The domain is registered through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains. As of the latest scan, 18 out of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on one security blocklist. The domain resolves to the IP address 74.115.51.9, associated with Weebly, Inc. (AS27647), and uses a Let’s Encrypt SSL certificate for encryption, which is typical of both benign and malicious sites. Users who visited tottalallianceemailsupport.weebly.com should immediately revoke any entered credentials, particularly if they were reused across other platforms. Organizations should audit logs for unauthorized access attempts originating from the affected accounts. If credentials were submitted, enable multi-factor authentication (MFA) on all critical accounts and monitor for suspicious activity. Additionally, report the domain to internal security teams or relevant incident response channels to prevent further exploitation.