ale[.]weebly[.]com

ale.weebly.com was registered on 21 February 2026 through Squarespace Domains II LLC and points to the IP address 74.115.51.8, which belongs to AS27647 owned by Weebly, Inc. The domain resolves to a server that presents a Let’s Encrypt certificate (E8) and is fronted by Cloudflare. DNS resolution uses four Amazon Route 53 name servers (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns). An HTTP request returns a 404 status and the page title reported by crawlers is “GMX.DE”, indicating an attempt to masquerade as the German mail service GMX. The threat profile classifies the site as a brand‑impersonation campaign targeting GMX users.

The domain is currently listed as offline, yet it appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis shows that 16 of 93 scanning engines raise detections, reinforcing the malicious assessment. Scamadviser assigns a trust score of 1 / 100, reflecting extreme risk. The combination of a low‑reputation trust score, multiple detections, and the presence of a brand‑specific page title suggests the site was designed to lure victims into entering GMX credentials or personal data.

However, no direct evidence of a login form or credential‑harvesting page has been captured, and the exact phishing kit remains unidentified. Defenders should add the domain and its IP to block lists, monitor DNS queries for the listed name servers, and enforce outbound filtering for HTTP 404 responses that contain the “GMX.DE” title. Continuous re‑scanning on VirusTotal and similar platforms is advised to capture any changes in payload. Organizations using GMX services should educate users about the offline status of this domain and advise them to verify URLs before entering credentials.