msupdated[.]weebly[.]com

This domain, msupdated.weebly.com, is flagged as an active credential phishing site targeting users through fake Microsoft update prompts. Analysis indicates the infrastructure is designed to harvest login credentials by mimicking legitimate software update pages, though no specific drainer kit has been conclusively identified. The page title "Just a moment..." suggests the use of anti-bot mechanisms to delay or filter automated security scans. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP 74.115.51.9 (AS27647, Weebly, Inc.), holds a VirusTotal detection score of 17/95 security vendors, and is registered through Squarespace Domains II LLC. The domain creation date is listed as February 21, 2026, which may indicate spoofed or manipulated registration data. It appears on one security blocklist and is currently blocked by PhishDestroy, though it remains accessible via certain network paths. The domain remains active as of this report, with elevated risk due to its credential harvesting capabilities and use of SSL encryption (Let’s Encrypt E8). Response actions should include immediate blacklisting of the IP and domain across security gateways, as well as monitoring for associated subdomains or redirect chains. Despite partial blocklist coverage, the domain poses a persistent threat to users unaware of phishing tactics, particularly those expecting software update notifications. Organizations are advised to update endpoint protection rules to include this domain and its resolved IP in threat intelligence feeds.