telstraaserviceadmin[.]weebly[.]com

This domain, telstraaserviceadmin.weebly.com, is identified as a phishing site impersonating Telstra, a major telecommunications provider. Analysis indicates the threat type is brand impersonation with a fake login page designed to harvest user credentials. The domain leverages Weebly’s hosting infrastructure, a common tactic to evade initial detection by blending with legitimate subdomains. No evidence of a crypto drainer kit or payment redirection was observed, but the credential theft vector remains high-risk for targeted users. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 74.115.51.9, hosted on AS27647 (Weebly, Inc.) in the United States. It was created on March 29, 2006, though the phishing content appears to be a recent deployment. The SSL certificate is issued by Let’s Encrypt (serial E8), a common choice for both legitimate and malicious sites. VirusTotal detection shows 21 out of 95 security vendors flagging the domain as malicious. The domain is registered through Safenames Ltd and appears on one security blocklist, with Google Safe Browsing (GSB) not currently listing it. These indicators suggest a moderately sophisticated operation, likely leveraging compromised or abused hosting services. The domain is currently offline, having been taken down following detection by security systems. However, residual risk remains due to potential credential exposure from prior interactions. Users who accessed the site before takedown should assume their credentials were compromised and initiate password resets on all accounts where the same credentials may have been reused. Organizations are advised to monitor for signs of credential-stuffing attacks or unauthorized access attempts linked to this campaign. The use of Weebly’s infrastructure highlights the need for continuous monitoring of subdomain-based phishing, particularly when targeting high-value brands.