junomaildior[.]weebly[.]com

This domain, junomaildior.weebly.com, is identified as a credential harvesting phishing site targeting users through brand impersonation. Analysis indicates the site is designed to mimic a luxury retail brand, likely Dior, to deceive victims into submitting sensitive login credentials or financial information. The domain is currently offline, but prior activity suggests it was actively used in a targeted phishing campaign. Infrastructure analysis reveals the domain was created on February 23, 2026, and registered through Squarespace Domains II LLC. It resolves to the IP address 74.115.51.9, associated with Weebly, Inc. (AS27647) in the United States. The domain appears on one security blocklist and is flagged by 19 of 95 security vendors on VirusTotal, indicating elevated detection rates. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites due to its accessibility. The page title, 'Un instant…,' suggests the use of a loading or redirect mechanism to obscure the phishing content from automated detection systems. Current status confirms the domain has been taken offline, likely in response to detection and reporting. However, the infrastructure remains a potential vector for future campaigns. Organizations and users are advised to block the domain and its resolving IP address (74.115.51.9) at the network level. Security teams should monitor for similar domains leveraging Weebly or Squarespace infrastructure, particularly those impersonating luxury brands. End-users should verify the legitimacy of any login pages claiming to represent high-value brands, especially those hosted on third-party platforms. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended.