ojegwg[.]weebly[.]com

Analysis of the domain ojegwg.weebly.com indicates it was actively hosting a credential phishing operation targeting users through a fraudulent verification portal. The domain, registered on March 29, 2006, and managed through MarkMonitor, Inc., resolved to IP address 74.115.51.9, located in the United States under AS27647 (Weebly, Inc.). Infrastructure analysis reveals the use of Weebly’s hosting platform, alongside supporting technologies including MySQL, PHP, Amazon Web Services, reCAPTCHA, jQuery, Google Analytics, and Cloudflare, suggesting an attempt to mimic legitimate service pages while leveraging automated protections to evade detection. The page title, 'Sign in to verify,' aligns with common phishing tactics designed to prompt users into submitting credentials under the guise of account validation.

The domain was flagged by 15 of 91 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy. A Let’s Encrypt SSL certificate (YE1) was present, providing a superficial layer of legitimacy, though such certificates are routinely issued to malicious domains. The site returned an HTTP 404 status at the time of assessment, indicating it has been taken offline, though residual DNS records and historical infrastructure data remain accessible. Defenders should treat this domain as a confirmed phishing threat, particularly given its association with credential harvesting as explicitly classified in available intelligence.

The use of Weebly’s platform, combined with Cloudflare and AWS nameservers, suggests the operators sought to blend into legitimate traffic while maintaining operational resilience. While the exact brand being impersonated is not specified in available data, the 'Sign in to verify' page title and credential phishing classification point to a likely attempt to harvest login credentials for a widely recognized service.