attmessageattyahoomail[.]weeblysite[.]com

This domain is flagged as a high-risk phishing infrastructure specifically designed for AT&T brand impersonation. Analysis indicates the site was constructed to deceive users into believing they are interacting with legitimate AT&T communications, as evidenced by the page title 'Home | att@message.att-mail.com' and the use of official branding elements. The threat type is classified as brand impersonation with credential harvesting as the likely objective, targeting AT&T customers through fraudulent login portals or account verification scams. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain attmessageattyahoomail.weeblysite.com was created on December 19, 2012, though the phishing content appears to have been deployed more recently. It resolves to IP address 74.115.51.54, hosted on AS27647 (Weebly, Inc.) in the United States, and uses an SSL certificate issued by Google Trust Services (WE1). The domain is registered through Safenames Ltd and is currently flagged by 20 out of 95 security vendors on VirusTotal. It appears on two security blocklists and is explicitly labeled as phishing by Google Safe Browsing. Additionally, the domain has been blocked by PhishDestroy and PhishingDB, further corroborating its malicious classification. Mitigation against this brand impersonation threat requires a multi-layered approach. Network-level protections should include blocking the domain and its resolving IP (74.115.51.54) at firewalls and DNS resolvers. Security teams should update endpoint detection rules to flag any attempts to access this domain or similar Weebly-hosted subdomains impersonating telecommunications providers. User awareness training should emphasize verifying sender domains in emails, particularly those requesting account credentials or personal information. AT&T customers should be advised to access their accounts exclusively through the official website (att.com) or verified mobile applications, and to report any suspicious communications to the company's official fraud reporting channels. Organizations should monitor for compromised credentials associated with this campaign, as phishing sites of this nature often harvest and exfiltrate login data in real time.