mail-pieas-edu-pk[.]weebly[.]com

The domain mail-pieas-edu-pk.weebly.com has been identified as a credential harvesting phishing site targeting users within the education sector. Analysis indicates this infrastructure was designed to impersonate legitimate academic login portals, likely to capture sensitive credentials such as student or faculty usernames and passwords. The domain is currently offline, but prior activity suggests it was actively used for malicious purposes. Infrastructure analysis reveals the domain was flagged by 19 of 95 security vendors on VirusTotal, indicating broad detection of its phishing intent. It was registered through MarkMonitor, Inc. on March 29, 2006, though the subdomain itself appears to have been weaponized more recently. The site resolved to IP address 74.115.51.8 and was hosted on Weebly’s platform, leveraging technologies such as PHP, MySQL, and Cloudflare for obfuscation. Additional technical indicators include a Let’s Encrypt SSL certificate, Google Analytics integration, and a Gridinsoft trust score of 0/100. The domain appeared on two security blocklists, including PhishDestroy and OISD, further confirming its malicious classification. Current status confirms the domain has been taken offline, though the underlying infrastructure remains a potential risk if reactivated. Organizations and individuals are advised to block the domain and its associated IP (74.115.51.8) at the network level. Users who may have interacted with the site should immediately reset credentials for any accounts accessed during the exposure window. Monitoring for similar subdomains under the weebly.com parent domain is recommended, as threat actors frequently repurpose free hosting services for phishing campaigns. Security teams should also review logs for connections to the resolved IP address to identify potential compromised endpoints.