weewux[.]sale

The domain weewux.sale was registered on February 21, 2026 through NiceNIC International Group Co., Limited. It resolves to 188.114.97.3, an IP owned by Cloudflare, AS13335, located in the United States. The site is served over HTTPS with a certificate issued by Google Trust Services under the WE1 identifier, indicating a valid TLS handshake. HTTP requests return status code 200 and the page title reported by scanners is “Weewux - Official Site”. Automated fingerprinting identifies a WordPress stack using MySQL, PHP, and several front‑end libraries such as Chart.js, Underscore.js, Slick, and the All in One SEO plugin. The presence of Google Maps suggests location‑based features, but the content of the page has not been manually inspected.

Reputation checks show mixed signals. Four of ninety‑three VirusTotal scanners flag the domain, and Google Safe Browsing classifies it as a social‑engineering threat. The domain appears on a single external blocklist and has been added to the PhishDestroy blocklist, confirming that at least one security organization regards it as malicious. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low confidence in the site’s legitimacy. No additional intelligence such as OTX references or malware payloads is available.

The evidence points to a newly created WordPress site that is likely being used for generic phishing, as indicated by the Safe Browsing social‑engineering label and the presence of a “Official Site” title. However, the exact target brand or credential‑harvesting mechanism cannot be confirmed without content analysis. Defenders should block DNS resolution for weewux.sale, deny HTTP/HTTPS traffic at the perimeter, and add the domain to internal blocklists. Monitoring of the Cloudflare IP for similar WordPress deployments is advisable, and any observed credential submissions to this host should be treated as compromised.