att-101098-103518[.]weeblysite[.]com

Analysis indicates that the domain att-101098-103518.weeblysite.com was registered on 21 February 2026 through SafeNames Ltd. and is hosted on the Weebly platform (ASN 27647). DNS resolution points to the IPv4 address 74.115.51.54, which resolves to a server located in the United States. The domain’s authoritative name servers are ns-1375.awsdns-43.org, ns-1854.awsdns-39.co.uk, and ns-510.awsdns-63.com, confirming use of Amazon Route 53 for DNS management. HTTPS is enabled with a certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS envelope but offering no assurance about the underlying content.

A request to the root of the site returns HTTP 404 with the page title “404 - Page Not Found”, and the site is currently reported as taken offline. Despite the inactive response, the domain appears on one external blocklist and is actively blocked by the PhishDestroy service. VirusTotal analysis shows that 15 of 93 scanned security vendors flagged the domain, reflecting a moderate detection consensus among AV engines. The presence of multiple detections, combined with the generic phishing classification, suggests the domain was used in a credential‑harvesting campaign or similar social‑engineering operation before being shut down.

Defenders should continue to block the domain at perimeter and endpoint layers, monitor DNS queries for the associated IP address and name‑server set, and consider adding the indicator to internal threat‑intel feeds. Because the site is presently offline, any future re‑activation would likely reuse the same infrastructure; therefore, periodic re‑resolution of the domain and re‑scanning with VirusTotal or other sandbox services is recommended. Logging of TLS handshakes may reveal additional payloads if the site becomes active again. The combination of recent registration, AWS DNS, Weebly hosting, and the observed detection profile warrants elevated vigilance for related phishing attempts.