trezo-webs[.]weebly[.]com

PhishDestroy identifies an active credential-harvesting campaign hosted at trezo-webs.weebly.com. This Weebly subdomain is being weaponized to mimic legitimate login portals, tricking users into surrendering sensitive credentials. The threat is classified as generic_phishing with a current risk level of under_investigation, indicating active reconnaissance and potential expansion across additional brands or services.

This domain was flagged by PhishDestroy’s seed 4804f2 and resolves to IP 74.115.51.9. VirusTotal currently shows 0 detections out of 95 engines, underscoring the evasiveness of the infrastructure. The domain is registered through MarkMonitor, Inc., a reputable registrar that has not yet suspended the domain despite its age—created on March 29, 2006. The presence of a Let’s Encrypt SSL certificate adds superficial legitimacy, while the complete lack of blocklist presence suggests this campaign is still in early operational phases. The combination of low detection coverage, long domain tenure, and registrar association with a major provider creates an elevated risk of prolonged abuse.

Users should immediately block trezo-webs.weebly.com at the DNS and network level to prevent credential submission attempts. Organizations are advised to inspect proxy logs and SIEM alerts for outbound connections to 74.115.51.9, particularly over HTTP POST requests to /login or similar endpoints. Since the SSL certificate is valid and signed by a trusted authority, browser-based warnings will not trigger; therefore, network-level blocking is essential. If a user has already entered credentials, assume compromise and initiate password resets and MFA re-enrollment across all related accounts. Report the domain to MarkMonitor’s abuse portal and request takedown while submitting indicators to threat intelligence platforms to improve detection coverage and reduce false negatives in scanning engines.