mybtvoicemailmessage-107422[.]weeblysite[.]com

Analysis of the domain mybtvoicemailmessage-107422.weeblysite.com shows it is currently offline, returning an HTTP 404 response. The domain resolves to the IP address 74.115.51.54, which is assigned to an AS27647 Weebly, Inc. hosting block located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 certificate authority, indicating the site was using a legitimate certificate chain despite its malicious purpose. The domain is registered through Safenames Ltd and was created on December 19, 2012, suggesting a long‑standing registration that may have been repurposed for abuse.

Infrastructure details reveal the use of Amazon Web Services and Cloudflare, as indicated by the detected technologies and the presence of four AWS Route 53 nameservers (ns-1375.awsdns-43.org, ns-1854.awsdns-39.co.uk, ns-510.awsdns-63.com, ns-522.awsdns). The page title returned by the server is "Just a moment...", which is a generic placeholder often observed on compromised or misconfigured sites. Threat intelligence feeds have flagged the domain on at least one security blocklist and it is listed as blocked by PhishDestroy. VirusTotal analysis shows that 13 out of 95 security vendors have marked the domain as malicious, reinforcing the suspicion of phishing activity.

The elevated risk rating reflects the combination of hosting, certificate, and vendor detections. Defenders should add the domain and its resolving IP to blocklists, ensure any outbound connections to the address are denied, and monitor for re‑activation. Continuous re‑scanning of the domain is advised to capture any future changes in status or content.