tiscalilogin[.]weebly[.]com

This domain is flagged for elevated risk due to its involvement in credential theft, specifically targeting users through fraudulent login portals designed to mimic legitimate telecom services. The infrastructure analysis reveals a deliberate attempt to deceive victims into submitting sensitive account credentials, which can lead to unauthorized access, financial fraud, or identity theft. The domain's activity aligns with known patterns of credential harvesting, where attackers exploit trust in well-known brands to facilitate data exfiltration. Analysis indicates the domain tiscalilogin.weebly.com resolves to the IP address 74.115.51.9, located in the United States under AS27647 (Weebly, Inc.). The domain was registered on March 29, 2006, through Safenames Ltd, a detail that contrasts with its recent malicious use. Security vendors on VirusTotal flagged the domain with 19 out of 95 detections, signaling moderate to high confidence in its malicious nature. The domain appears on two security blocklists and is actively blocked by PhishDestroy and PhishingDB. Its SSL certificate, issued by Let's Encrypt (serial number E8), provides a veneer of legitimacy but does not mitigate the underlying threat. The combination of these indicators—IP reputation, blocklist presence, and vendor detections—confirms the domain's role in credential theft operations. To mitigate risks associated with this credential theft campaign, organizations and individuals should implement the following measures. First, block the domain and its associated IP address (74.115.51.9) at the network level to prevent access. Second, deploy email and web filtering rules to detect and quarantine messages or links referencing tiscalilogin.weebly.com. Third, conduct user awareness training to educate employees and customers on recognizing fraudulent login portals, particularly those impersonating telecom services. Fourth, monitor for unusual authentication attempts or credential reuse patterns that may indicate compromise. Finally, report the domain to relevant security communities to contribute to broader threat intelligence efforts and aid in takedown initiatives.