talktalklkh[.]weebly[.]com

Analysis of the domain talktalklkh.weebly.com indicates it was a phishing page targeting TalkTalk customers, now offline. The domain was registered on February 22, 2026, through Squarespace Domains II LLC and hosted on Weebly’s infrastructure (AS27647, IP 74.115.51.9, United States). Nameservers point to AWS DNS endpoints, while the SSL certificate was issued by Let’s Encrypt (serial E8). At the time of assessment, the domain returned an HTTP 404 status, and its page title displayed 'Just a moment...', a common Cloudflare interstitial response rather than the original phishing content.

Security vendor detections on VirusTotal reached 15 of 95 engines, confirming malicious classification. The domain appears on one security blocklist, and PhishDestroy had already blocked access. Infrastructure analysis reveals the use of Cloudflare, likely as a proxy to obscure backend hosting. The domain’s creation date and hosting provider align with patterns observed in phishing campaigns leveraging free website builders to evade detection.

While the exact phishing kit or lure remains unconfirmed, the domain name suggests an attempt to impersonate TalkTalk, a UK telecommunications provider. Defenders should treat this domain as compromised and maintain blocklist entries. No further live content is accessible, but historical captures or passive DNS may provide additional context. Organizations should monitor for related domains registered through the same registrar or hosted on Weebly’s infrastructure, particularly those using similar naming conventions or AWS nameservers.