sign-into-your-att-account-106137[.]weeblysite[.]com

The domain sign-into-your-att-account-106137.weeblysite.com is flagged as a credential phishing site. It resolves to the IPv4 address 74.115.51.55, which is assigned to the United States under AS27647 belonging to Weebly, Inc. The registration record shows the domain was created on 19 December 2012 through Safenames Ltd, and the authoritative name servers are ns‑1375.awsdns‑43.org, ns‑1854.awsdns‑39.co.uk, ns‑510.awsdns‑63.com, and ns‑522.awsdns. The presence of AWS name servers together with detected Amazon Web Services and Cloudflare infrastructure indicates the site leveraged cloud hosting, while the SSL certificate presented by Google Trust Services (WE1) demonstrates that TLS was provisioned to lend credibility to the phishing page. An HTTP request to the host returns a 404 status, and the only page title captured is "Nur einen Moment…", which offers no functional content.

VirusTotal scans show that 14 of 95 security vendors have flagged the domain, and it appears on at least one public blocklist. The site has been taken offline and is currently blocked by the PhishDestroy sinkhole, confirming that active hosting has been disrupted. However, the underlying infrastructure—particularly the AWS‑based name servers and the Weebly IP—remains reusable, so the operators could reactivate the domain or clone the campaign to a new sub‑domain. Defenders should continue to block traffic to the resolved IP address and to the full FQDN at perimeter firewalls and DNS filtering solutions.

Adding the domain to internal threat‑intel feeds and ensuring endpoint web‑filtering products ingest the latest blocklist entries will reduce exposure. Monitoring the registrar Safenames Ltd for any new registrations that resemble the observed pattern, and watching for rapid DNS changes on the same name servers, can provide early warning of potential re‑deployment.