mailattonline-00817450[.]weeblysite[.]com

PhishDestroy identifies the active domain mailattonline-00817450.weeblysite.com as a generic phishing lure that serves as a crypto drainer, designed to deceive users into connecting malicious cryptocurrency wallets. This domain does not impersonate a single specific brand but instead casts a wide net with a generic mail “at” branding aimed at harvesting wallet credentials or triggering unauthorized transfers. The infrastructure leverages a simple Weebly-hosted landing page (weeblysite.com) to avoid enterprise-grade scrutiny while delivering the drainer payload to visitors. Seed 841835 uniquely ties this infrastructure to a long-running campaign observed since the domain’s creation in late 2012. Technical indicators collated by PhishDestroy include a VirusTotal detection ratio of 20 positive engines out of 95 scanners, placing this domain at high risk. The registrar is MarkMonitor, Inc., a domain used frequently to obscure ownership. The IP resolution points to 74.115.51.55, a hosting endpoint with a poor reputation due to prior crypto-drainer activity. Domain registration occurred on December 19, 2012, indicating longevity rather than a quick burn-and-churn approach. Google Safe Browsing classifies the page under the “SOCIAL_ENGINEERING” flag, and OpenPhish has already blacklisted the domain. The combination of a 20/95 VT score plus single blocklist entry reinforces the high-risk classification. The domain remains ACTIVE as of seed 841835, with the underlying IP still resolving and the SSL certificate issued by Google Trust Services lending a veneer of legitimacy. PhishDestroy’s automated systems continue to block traffic to this destination, and end users are urged to verify any unsolicited link via PhishDestroy’s real-time lookup tool. Despite mitigation efforts, residual risk persists because the drainer payload is modular and may be redeployed on newly spun subdomains or neighboring hosts. Users should treat any mail-related landing page under this domain as hostile and refrain from entering wallet addresses or private keys.