btilloovvvvvvvooooo[.]weebly[.]com

Analysis of btilloovvvvvvvooooo.weebly.com shows a domain hosted on the Weebly platform (AS27647) with the IP address 74.115.51.9 located in the United States. The domain was registered on March 29, 2006 through Safenames Ltd and is served by Cloudflare. DNS resolution uses four Amazon Route 53 name servers (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns). A Let’s Encrypt certificate (E8) is present, confirming the site was reachable via HTTPS, although the HTTP response returns a 404 status code, indicating the page is not currently delivering content.

The page title returned by the server is “BT”, matching the declared brand target and confirming the intent of brand impersonation. Security telemetry shows that 17 of 95 VirusTotal scanners flagged the domain, and it appears on one public blocklist. PhishDestroy has already taken the site offline, and the Scamadviser trust score is 1 / 100, reflecting extreme risk. The combination of a low trust score, multiple vendor detections, and active blocklisting suggests the domain was being used for fraudulent activity aimed at BT customers.

Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated name servers, and add the IP address 74.115.51.9 to deny lists. Because the site is hosted on a shared SaaS platform, any future re‑hosting of similar content could reuse the same infrastructure; therefore, security teams should watch for new subdomains under the same registrar or hosting provider that reference the BT brand. At present, no additional content has been captured, so further investigation should focus on any residual URLs or email campaigns that reference this domain.