Definition
Free website-building platforms (Weebly, Wix, and similar drag-and-drop site builders) let anyone create a working page in minutes with no server, domain purchase, or technical setup required, using only a free account. Some phishing operators exploit the exact same convenience: they build a fake login page inside the platform, styled to imitate a real company, and let the platform's own account or form-processing features handle receiving whatever gets typed in. The entire operation runs on infrastructure the platform itself already provides, not anything the scammer had to build.
How It Compares
| What it looks like | What it actually is | |
|---|---|---|
| The page | A real company's login screen | A page built inside a free website-builder account, using the real company's logo and wording |
| Where a password goes | Assumed to go to the company being imitated, or at least to a server the scammer set up | Routed through the website-builder platform's own account or form API, the same feature a legitimate site owner uses to manage their account |
| Setup effort implied | A server, a domain, infrastructure to receive stolen data | None of that. A free platform account supplies hosting, the form, and the delivery channel together |
The Evidence
The Telstra webmail case: a page at a free Weebly subdomain presented a "Sign in to Telstra
webmail" form using Telstra's real logo (pulled directly from an uploaded image named
logo-telstra-new.png). Submitting the login form sent the data to
https://<site>.weebly.com/ajax/api/JsonRPC/CustomerAccounts/, Weebly's own platform API for
managing an account, rather than to any separate, attacker-registered domain. We could not see
what happens to the submitted data after that call reaches the operator's own Weebly account, so
we're describing this as a well-supported inference from the request target and known abuse
patterns for this kind of platform, not a directly observed fact. Independent of that inference,
the page itself was corroborated by VirusTotal (9 vendors flagged it, including a specific
"phishing and fraud" categorization), and had two low-effort authoring tells: the password field
was labeled "Passvvord" (a double-v typo), and a line of unfinished template text read "Back to
previous for:" with nothing filled in.
What To Do About It
For individual users:
- Check the actual address bar, not just the logo, before entering a password. A URL ending in
a website-builder's own domain (
weebly.com, or similar) is never a real company's login page, regardless of how convincing the branding looks. - Typos or broken placeholder text in security-sensitive fields (a misspelled password label, an incomplete sentence) are a fast, no-tools-needed tell that a page was assembled quickly from a template rather than built by the company it claims to be.
For security researchers and platform-abuse teams:
- When triaging a phishing page hosted on a consumer site builder, check where its login form actually submits. The exfiltration channel can be the hosting platform's own API rather than a separate suspicious domain, so the absence of an external POST target doesn't mean the page is safe.
- Report abuse to the hosting platform directly, in addition to any standard domain/registrar takedown request. Removing a domain doesn't apply here since no separate domain was registered; the platform itself is the only party that can remove the page.
Caveats & Edge Cases
This is a single documented case, not yet a confirmed pattern across multiple investigations in our own data, though the general technique (building phishing pages on free consumer platforms) is well known. We did not verify where submitted credentials go after they reach the platform's API, since that requires access to the operator's own account. A few contact-looking values (a placeholder email address, a couple of clearly-fake phone numbers) turned up in our raw evidence and are almost certainly leftover template defaults from the website-builder theme, not real attacker contact information, so we've excluded them here.