lakelomi[.]weebly[.]com

This domain is flagged for hosting credential harvesting phishing infrastructure, classified under generic_phishing with an elevated risk level. The site, currently offline, targeted users through deceptive login prompts designed to capture sensitive authentication details, including usernames, passwords, and potentially multi-factor authentication codes. Analysis indicates the domain was actively used in phishing campaigns prior to takedown, with residual risk remaining for users who may have interacted with it before deactivation. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain lakelomi.weebly.com resolves to IP address 74.115.51.9 and was registered through MarkMonitor Inc., a registrar commonly associated with both legitimate and malicious domains. It was created on April 28, 2026, an unusually future-dated registration that may indicate domain squatting or pre-planned malicious activity. The site appears on two security blocklists (PhishDestroy and OISD) and is detected by 16 out of 95 security vendors on VirusTotal. Trust scores from independent assessment platforms are critically low, with Scamadviser assigning a 1/100 rating and Gridinsoft a 0/100. The SSL certificate is issued by Let’s Encrypt, a common tactic among threat actors to lend superficial legitimacy. Detected technologies include Weebly (hosting platform), MySQL, PHP, Amazon Web Services (likely for backend infrastructure), Twitter integration, reCAPTCHA, jQuery, and Google Analytics, suggesting an attempt to mimic legitimate business or blog infrastructure. Mitigation against credential harvesting phishing requires immediate and multi-layered response. Organizations and individuals who may have interacted with lakelomi.weebly.com should invalidate any credentials entered on the site, particularly if reused across other platforms. Security teams should review logs for connections to 74.115.51.9 and the domain itself, correlating with authentication attempts or anomalous login activity. Domain registrars and hosting providers should be notified of the malicious infrastructure to prevent reactivation under similar names. Users should enable multi-factor authentication on all critical accounts and deploy phishing-resistant authentication methods where possible. Network-level protections, including DNS filtering and endpoint detection, should be configured to block known malicious indicators, including the domain, IP, and associated blocklist entries. Continuous monitoring for credential misuse is recommended, as harvested data may be exploited in follow-on attacks.