appuphold[.]weebly[.]com

The domain appuphold.weebly.com was registered through MarkMonitor Inc. on March 29, 2006 and currently resolves to the IPv4 address 74.115.51.8. Google Safe Browsing has flagged the site for social engineering, and VirusTotal reports that 13 of 91 scanned security vendors have marked the host as malicious. The domain is listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Its DNS infrastructure uses four AWS Route 53 name servers (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns), indicating reliance on Amazon’s cloud DNS service.

Analysis indicates that the host is being used for a generic phishing campaign, though the specific target brand or credential‑stealing page content has not been disclosed in the available intelligence. The long‑standing registration date and the use of a free‑hosting subdomain (weebly.com) suggest the operators may be leveraging compromised or low‑cost accounts to host malicious content while benefiting from the reputation of the parent domain. The presence of multiple security‑vendor detections and inclusion on blocklists confirms that the infrastructure is recognized as high‑risk, aligning with the assigned risk level of “high”. Defenders should continue to block DNS resolution for appuphold.weebly.com at the network perimeter and ensure that web filtering solutions reference the listed blocklists and the three explicit block‑list providers.

Incident response teams should monitor for any outbound connections to 74.115.51.8 and correlate internal logs for attempts to access the domain, especially from users handling sensitive credentials. Because the exact phishing page content is unknown, threat‑intel feeds should be queried for any newly observed payloads or URLs associated with this host, and any detection of credential submission should trigger immediate containment and credential reset procedures.