currentlyattcommsyahoonet[.]weeblysite[.]com

This domain, currentlyattcommsyahoonet.weeblysite.com, is identified as a high-risk brand impersonation threat specifically targeting AT&T, a major telecommunications provider. Analysis indicates the site mimics legitimate AT&T communications infrastructure, presenting itself under the deceptive page title 'Home | currently@att.comms.yahoo.net.' No evidence of a crypto drainer kit or direct financial malware was observed, but the domain’s primary function appears to be credential theft or fraudulent account access under the guise of official AT&T correspondence.

Technical indicators confirm the domain’s malicious nature. The domain was registered on December 19, 2012, through Safenames Ltd, an unusual registrar for consumer-facing phishing sites. It resolves to IP address 74.115.51.54, hosted on AS27647 (Weebly, Inc.) in the United States. Google Safe Browsing explicitly flags the domain as phishing, and VirusTotal reports 17 out of 95 security vendors detecting malicious activity. The domain appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, providing a false sense of legitimacy to unsuspecting users.

As of the latest assessment, currentlyattcommsyahoonet.weeblysite.com has been taken offline, likely due to enforcement actions by hosting providers or security teams. However, the infrastructure remains a residual risk. The domain’s long-standing registration and use of a reputable hosting platform suggest potential for reactivation or migration to alternative domains. Users who interacted with this site should immediately reset credentials for AT&T accounts and any other services where identical login details were reused. Organizations should monitor for similar domains leveraging Weebly’s hosting services and AT&T’s branding, particularly those using yahoo.net subdomains in their page titles.