bt-109788[.]weeblysite[.]com

The domain bt-109788.weeblysite.com was registered on February 23, 2026 through SafeNames Ltd. and resolves to the IP address 74.115.51.54, which is assigned to AS27647 (Weebly, Inc.) in the United States. The site was served over HTTPS using a Google Trust Services certificate identified as WE1, indicating that the TLS termination was handled by a legitimate certificate authority. Automated probing returned an HTTP 404 response and the page title reported by the server is "Just a moment...", a generic placeholder that provides no insight into the intended content.

Google Safe Browsing has flagged the domain for social engineering, and 16 of 95 security vendors on VirusTotal have marked it as malicious, reflecting a consensus of suspicious behavior. The infrastructure is built on Amazon Web Services and fronted by Cloudflare, a common combination for both legitimate and malicious actors. The domain appears on a single security blocklist and has been taken offline, with the takedown attributed to the PhishDestroy mitigation service.

Defenders should add explicit deny rules for the domain and its resolved IP address to perimeter firewalls and DNS filtering solutions. Monitoring should extend to other subdomains under the same registrar and to any new domains resolving to the same IP range, as adversaries often reuse hosting assets. Continuous re‑evaluation of the threat posture is advised, given the relatively recent registration date and the presence of multiple security vendor detections.