p9dtufdd67v[.]weebly[.]com

This domain is flagged as a high-risk credential theft phishing site, designed to harvest sensitive user login credentials through deceptive web forms. Analysis indicates the infrastructure is actively abused for malicious purposes, with no legitimate use case identified. The domain poses an immediate threat to users who may unknowingly submit personal or corporate authentication details. Infrastructure analysis reveals the domain p9dtufdd67v.weebly.com resolves to the IP address 74.115.51.8, hosted under AS27647 (Weebly, Inc.) in the United States. The domain was originally registered on March 29, 2006, through MarkMonitor, Inc., though the subdomain itself appears to have been recently repurposed for malicious activity. Detection metrics show 18 out of 95 security vendors on VirusTotal flagging the domain as malicious, while a single security blocklist (PhishDestroy) has already classified it as phishing. Google Safe Browsing further confirms the phishing classification, and the SSL certificate is issued by Let's Encrypt (identifier YE1), a common choice for both legitimate and malicious sites due to its accessibility. Mitigation against credential theft phishing requires immediate action from both end users and network administrators. Users should avoid interacting with the domain or any linked resources, particularly forms requesting login credentials. Organizations should block the domain and its resolving IP (74.115.51.8) at the firewall or DNS level to prevent access. Multi-factor authentication (MFA) should be enforced for all accounts to reduce the impact of stolen credentials. Security teams are advised to monitor logs for connections to the domain or IP, as any interaction may indicate a compromised endpoint. Given the domain's offline status, continuous monitoring for reactivation or similar subdomains under the same registrar is recommended.