hjgfhg[.]weeblysite[.]com

Analysis of hjgfhg.weeblysite.com shows the domain is currently offline but retains a record of malicious activity. The site was registered on December 19, 2012 through Safenames Ltd and is hosted on Amazon Web Services infrastructure with Cloudflare front‑end services. DNS resolution points to IP address 74.115.51.55, which belongs to AS27647, identified as Weebly, Inc. in the United States. The SSL certificate presented by the server is issued by Google Trust Services under the WE1 root, indicating a standard Google‑issued certificate rather than a self‑signed or fraudulent chain. HTTP probing returned a 404 status code, and the only visible page title is the Portuguese phrase "Um momento…", providing no clear indication of the intended victim lure.

VirusTotal has recorded 14 detections out of 95 scanned engines, confirming that multiple security products classify the domain as malicious. The domain appears on a single public blocklist and is explicitly listed by PhishDestroy, reinforcing its identification as a phishing vector. No additional threat intelligence feeds such as OTX or Safe Browsing URLs are referenced in the supplied data.

Defenders should continue to block the domain at perimeter controls, DNS sinks, and proxy layers, leveraging the known IP address and identified nameservers (ns-1375.awsdns-43.org, ns-1854.awsdns-39.co.uk, ns-510.awsdns-63.com, ns-522.awsdns). Monitoring for new resolution records or changes to the SSL certificate is advisable, as the infrastructure could be reactivated under a different subdomain. Given the limited visibility beyond the 404 response, threat hunters should treat any traffic to the domain as malicious and correlate it with credential‑theft patterns or user‑reported phishing incidents. The combination of multi‑vendor detections, blocklist inclusion, and the presence of a generic phishing page title justifies maintaining an elevated risk posture until the domain is fully retired.