btinternet-101774[.]weeblysite[.]com

Analysis of the domain btinternet-101774.weeblysite.com indicates a brand impersonation phishing campaign targeting BT, as identified by its page title 'Home | btinternet' and explicit classification in threat intelligence sources. The domain was registered through Safenames Ltd on December 19, 2012, though its malicious use appears to have been detected more recently, as evidenced by its presence on a single security blocklist (PhishDestroy). Infrastructure analysis reveals the domain resolves to the IP address 74.115.51.55, hosted under AS27647 (Weebly, Inc.) in the United States, with nameservers distributed across Amazon Web Services (ns-1375.awsdns-43.org, ns-1854.awsdns-39.co.uk, ns-510.awsdns-63.com, ns-522.awsdns). The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious sites, offering no definitive indication of intent.

Detection metrics show the domain was flagged by 15 of 95 security vendors on VirusTotal, suggesting moderate consensus on its malicious nature, though the specific nature of the payload or phishing kit remains unconfirmed. The domain currently returns an HTTP 404 status, indicating it has been taken offline or is no longer serving content, though historical activity may still pose a risk to users who encountered it prior to removal. Scamadviser assigns a trust score of 1 out of 100, further corroborating its classification as high-risk. Defenders should treat this domain as part of a broader pattern of BT brand impersonation, particularly given its use of Weebly’s hosting infrastructure, which has been recurrently exploited for similar campaigns.

While the domain is offline, monitoring for re-activation or related domains with similar naming conventions (e.g., 'btinternet-' prefixes) is recommended. Blocking the IP 74.115.51.55 and associated Weebly-hosted subdomains may mitigate residual risk.