btvoicemailmessage-103932[.]weeblysite[.]com

Analysis indicates that btvoicemailmessage-103932.weeblysite.com was hosted on the Weebly infrastructure (IP 74.115.51.55, AS27647) and leveraged Amazon Web Services and Cloudflare services. The domain was registered on December 19, 2012 through Safenames Ltd and is associated with a Scamadviser trust score of 1/100, reflecting a high likelihood of abuse. DNS resolution points to four Amazon‑owned name servers (ns-1375.awsdns-43.org, ns-1854.awsdns-39.co.uk, ns-510.awsdns-63.com, ns-522.awsdns).

An SSL certificate issued by Google Trust Services (WE1) was observed, but the HTTP response returned a 404 – Page Not Found status and the page title mirrors that code, suggesting the site is no longer serving content. VirusTotal reports that 14 of 95 scanned security vendors flagged the domain, and it is listed on a single external blocklist and has been actively blocked by PhishDestroy. The presence of AWS and Cloudflare indicates a flexible hosting environment that can be repurposed for malicious campaigns, while the low trust score and multiple vendor detections corroborate its classification as a generic phishing infrastructure.

No additional threat intelligence such as OTX or Safe Browsing entries were provided, leaving the broader campaign context unknown. Defenders should continue to block the domain at perimeter and DNS filtering layers, monitor for any re‑activation of the host IP, and consider adding the IP address to reputation‑based deny lists. Ongoing observation of the associated name servers is advised, as they may be reused for future phishing deployments.