attteam12[.]weebly[.]com

Analysis of attteam12.weebly.com indicates an active phishing infrastructure hosted on Weebly's platform, a common vector for credential-harvesting campaigns. The domain, created on March 29, 2006, is registered through MarkMonitor, Inc., and resolves to IP address 74.115.51.9. As of July 29, 2026, the domain is flagged by 14 of 91 security vendors on VirusTotal, suggesting detection by multiple engines, though the specific detection rules or payloads are not detailed in available intelligence. It appears on at least one security blocklist, further supporting its classification as malicious. The nameservers (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns) are associated with Amazon Web Services, a frequent hosting choice for both legitimate and malicious domains due to its scalability and low cost.

The domain's classification as 'generic phishing' implies it is likely designed to harvest credentials or sensitive information, though the exact brand or service being impersonated is not specified in the available data. Defenders should note that Weebly-hosted phishing sites often leverage the platform's subdomain structure to evade initial scrutiny, as the parent domain (weebly.com) is generally trusted. The elevated risk level is justified by the combination of vendor detections, blocklist inclusion, and the domain's active status. No HTTP status, SSL certificate details, or page content analysis are provided, so the specific lure or target (e.g., corporate login, financial service) remains unconfirmed.

Recommended actions include blocking the domain at the DNS or proxy level, monitoring for connections to the resolving IP (74.115.51.9), and reviewing logs for any prior interactions with this subdomain. If internal users have accessed the site, credentials potentially exposed should be reset, and multi-factor authentication (MFA) should be enforced where applicable.