gmxxdes[.]weebly[.]com

Analysis indicates that the domain gmxxdes.weebly.com is actively employed for brand impersonation of the GMX email service. The site presents the page title "gmx.de," directly referencing the targeted brand. Registration data shows the domain was created on February 21, 2026 and was purchased through Squarespace Domains II LLC. Network resolution points to the IP address 74.115.51.8, which is hosted in the United States and belongs to AS27647, the Weebly Inc. network. The server presents a valid Let’s Encrypt certificate (E8 series) and responds with HTTP status 200. Automated fingerprinting reveals a stack that includes Weebly, MySQL, PHP, Amazon Web Services, reCAPTCHA, jQuery, Google Analytics, and Cloudflare, all typical of a publicly‑hosted web builder environment. The domain is currently listed on one security blocklist and has been blocked by the PhishDestroy service. VirusTotal scans show that 17 of 93 security vendors have flagged the domain, and the Gridinsoft trust score is 0 out of 100, reinforcing a high‑risk assessment. While the exact malicious payload or credential‑stealing mechanisms have not been publicly disclosed, the combination of brand‑targeted page title, hosting profile, and multiple vendor detections strongly supports a brand‑impersonation classification. Defenders should add gmxxdes.weebly.com to network block lists, monitor DNS queries for the domain, and educate users that any unsolicited request to log into a GMX account via a URL containing "weebly.com" is likely fraudulent. Continuous re‑evaluation is advised should additional content or phishing kit details emerge.