webde-108445[.]weeblysite[.]com

Analysis conducted on July 23, 2026 identifies the domain webde-108445.weeblysite.com as an active brand‑impersonation infrastructure targeting users of the German email service Web.de. The site resolves to the IPv4 address 74.115.51.54, which is owned by AS27647 (Weebly, Inc.) and is geolocated to the United States. The domain was registered on 19 December 2012 through Safenames Ltd, and its authoritative name servers are ns-1375.awsdns-43.org, ns-1854.awsdns-39.co.uk, ns-510.awsdns-63.com, and ns-522.awsdns. TLS inspection shows a certificate issued by Google Trust Services under the WE1 label, indicating the use of a standard public‑key infrastructure rather than a self‑signed certificate.

HTTP probing returned a 404 status code, and the page title reported by the scanner is “Home | WEB.DE”, matching the targeted brand. The underlying hosting stack includes Amazon Web Services and Cloudflare services, which are commonly leveraged to provide scalability and hide the true origin of malicious content. The domain appears on one security blocklist and is currently blocked by the PhishDestroy service. VirusTotal scans have recorded 14 detections out of 95 participating vendors, reinforcing the suspicion of malicious activity.

While the site is presently taken offline, the combination of brand‑specific page title, confirmed IP ownership, registrar information, and multiple vendor detections provides sufficient confidence to classify this domain as a confirmed Web.de impersonation attempt. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms that may have been hosted before takedown, as no visual content or form details were captured. Defenders should continue to block the domain at perimeter filters, update URL reputation feeds, and monitor for any re‑registration attempts that reuse the same sub‑domain pattern or hosting providers.