pelumipeller[.]weebly[.]com

The domain pelumipeller.weebly.com was identified as a brand impersonation threat targeting AT&T customers. Analysis confirms the site hosted a fake login portal designed to harvest credentials under the guise of the telecommunications provider. The domain is currently offline, though prior activity suggests it was operational long enough to pose a risk to unsuspecting users. Infrastructure analysis reveals the domain was flagged by 18 of 95 security vendors on VirusTotal, indicating widespread detection of malicious intent. It was registered through Safenames Ltd. on March 29, 2006, though the subdomain’s malicious use appears to be a more recent development. The domain resolved to the IP address 74.115.51.8, hosted under AS27647 (Weebly, Inc.) in the United States. A Let’s Encrypt SSL certificate (serial number E8) was deployed, likely to lend an air of legitimacy. The domain appeared on one security blocklist, specifically PhishDestroy, and displayed a generic page title of 'Home' to avoid immediate suspicion. At present, pelumipeller.weebly.com has been taken offline, though residual risk remains for users who may have interacted with it during its active phase. Organizations are advised to monitor for credential reuse attempts tied to this domain, particularly from accounts associated with AT&T services. Network defenders should update blocklists to include the domain and its resolved IP, while end users should be reminded to verify URLs before entering sensitive information. If credentials were submitted, immediate password resets and multi-factor authentication enforcement are recommended.