att021[.]weebly[.]com

Analysis of att021.weebly.com indicates that the domain was used to impersonate AT&T and is now taken offline, returning HTTP 404 for all requests. The domain resolves to IP 74.115.51.9, which is assigned to AS27647 (Weebly, Inc.) and is located in the United States. Hosting infrastructure includes Cloudflare as a front‑end service, while the underlying web content was served from the Weebly platform, as reflected by the nameserver set (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns). The site employed an SSL certificate issued by Let’s Encrypt (certificate identifier E8), confirming that TLS was active at the time of observation.

The page title captured during the brief crawl was "Login Screen - Home," which aligns with a credential‑collection motive, though the actual page content was not captured before the site was disabled. VirusTotal recorded 18 positive detections out of 93 scanning engines, and the domain is listed on one external blocklist. It has also been flagged by the PhishDestroy mitigation service. Registration details show the domain was created on 29 March 2006 and was registered through Safenames Ltd., a registrar commonly associated with legitimate registrations.

No additional threat‑intel feeds (OTX, Safe Browsing, etc.) were supplied. The combination of a brand‑specific page title, a TLS certificate, and multiple vendor detections strongly supports the conclusion that the site was a deliberate AT&T impersonation campaign. Defenders should add att021.weebly.com to URL filtering and DNS blocklists, monitor the associated IP address (74.115.51.9) for any future activity, and watch for similarly structured Weebly subdomains that target AT&T or other telecom brands. Because the site is currently offline, continuous probing is unnecessary, but periodic re‑resolution of the domain and its IP can confirm whether the infrastructure is repurposed for new malicious campaigns.