my-site-100781-102018[.]weeblysite[.]com

Analysis of my-site-100781-102018.weeblysite.com indicates a confirmed brand impersonation campaign targeting BT, classified as elevated risk. The domain, registered on December 19, 2012, through Safenames Ltd, was taken offline following detection by PhishDestroy and flagging by 13 of 95 security vendors on VirusTotal. Infrastructure analysis reveals hosting on Weebly, Inc. (AS27647) in the United States, resolving to IP 74.115.51.54. The domain appears on one security blocklist, and its HTTP status returned a 404 at the time of assessment, confirming its current offline status.

Nameservers are hosted on Amazon Web Services (ns-1375.awsdns-43.org, ns-1854.awsdns-39.co.uk, ns-510.awsdns-63.com, and ns-522.awsdns), with Cloudflare also detected in the technology stack. The SSL certificate is issued by Google Trust Services (WE1), a common but not inherently malicious provider. The page title, 'Home | .', offers no additional context about the site's content, though the scam type is explicitly identified as brand impersonation targeting BT. Defenders should treat this domain as a confirmed threat vector, particularly given its historical use in phishing operations.

While the domain is currently offline, its infrastructure (Weebly hosting, AWS nameservers, and Cloudflare) aligns with patterns observed in other impersonation campaigns. No evidence suggests persistence or active exploitation at this time, but monitoring for reactivation or similar domains on the same infrastructure is recommended. The registration date predates the reported scam activity, which may indicate domain repurposing or delayed malicious use.