bt-107154-104049[.]weeblysite[.]com

Analysis indicates that bt-107154-104049.weeblysite.com was registered on December 19, 2012 through Safenames Ltd and is hosted on Amazon Web Services behind Cloudflare. The domain resolves to IP 74.115.51.54, which belongs to AS27647 (Weebly, Inc.) in the United States. DNS records show four AWS name servers: ns-1375.awsdns-43.org, ns-1854.awsdns-39.co.uk, ns-510.awsdns-63.com, and ns-522.awsdns. An HTTPS connection is served with a Google Trust Services certificate (WE1), but the underlying web server returns HTTP 404 for the requested resource. The page title captured during a scan reads “Nur einen Moment…”, a generic German phrase meaning “Just a moment…”.

No brand or credential‑harvesting page content has been observed, and the site’s purpose remains undefined. Reputation data is poor: Scamadviser assigns a trust score of 1/100, and the domain appears on one security blocklist. VirusTotal reports that 14 of 95 scanning engines flagged the domain, indicating a non‑trivial level of malicious detection. PhishDestroy lists the domain as blocked, confirming that at least one anti‑phishing service has taken action. The current operational status is offline, suggesting the site has been taken down or is otherwise inaccessible.

For defenders, the immediate mitigation step is to block DNS resolution to bt-107154-104049.weeblysite.com and to deny traffic to its IP address 74.115.51.54. Because the infrastructure uses AWS and Cloudflare, monitoring for additional sub‑domains or new hostnames under the same name‑server set is advisable. Threat‑intel feeds should be updated to reflect the 14 VirusTotal detections and the PhishDestroy blocklist entry. Organizations should also consider inspecting any outbound connections that attempt to reach the associated AWS ASN, as adversaries may reuse this hosting pattern for future campaigns. Continuous re‑evaluation is recommended in case the site becomes active again or new evidence about the phishing target emerges.