helpslive-eng[.]weebly[.]com

PhishDestroy identifies helpslive-eng.weebly.com as an active brand impersonation scam leveraging the HelpScout identity to deploy crypto drainers. This domain was flagged under generic_phishing with a risk level of under_investigation but exhibits strong indicators of malicious intent, including a recently registered SSL certificate, a long-standing but suspicious hosting footprint, and zero VirusTotal detections despite active campaigns.

This domain resolves to IP 74.115.51.9 and is registered through MarkMonitor, Inc., a registrar often abused by threat actors for bulk domain registrations. The domain was created on March 29, 2006, which may suggest either a hijacked legitimate domain or a long-term strategic registration. VirusTotal currently reports 0 detections out of 95 engines, indicating a low detection rate likely due to zero-day or evasive payload delivery mechanisms. The use of Weebly as a hosting platform further obscures malicious infrastructure under a reputable content management system.

To mitigate risk, organizations should immediately block helpslive-eng.weebly.com at the network and DNS levels. Users should avoid interacting with any links or forms hosted on this domain, especially those requesting cryptocurrency transfers or login credentials. Security teams should scan endpoints for unauthorized connections to IP 74.115.51.9 and inspect outbound traffic for crypto drainer signatures. Additionally, report this domain to abuse channels and threat intelligence platforms to improve detection coverage and prevent further abuse.