cashtrust[.]co

The domain cashtrust.co has been identified as a sophisticated brand impersonation phishing threat specifically targeting GoDaddy customers. Analysis by PhishDestroy confirms that this domain employs a fake login page designed to harvest user credentials, posing a significant risk to unsuspecting GoDaddy users. No specific crypto drainer kit was identified, but the credential harvesting mechanism itself can lead to account compromise and financial loss.

Technical analysis reveals alarming indicators: VirusTotal flagged this domain with a score of 10 out of 95 security vendors, underscoring its malicious nature. The domain was registered through Porkbun LLC on August 11, 2025, and resolves to IP address 104.75.88.77. Despite being taken offline, it remains on at least one security blocklist and was mentioned in one AlienVault OTX threat intelligence pulse. The SSL certificate was issued by GoDaddy's own Certificate Authority, which adds a layer of deception by appearing legitimate to users who check for HTTPS.

As of the latest report, cashtrust.co is offline, likely due to takedown actions by security teams or hosting providers. However, the risk of copycat domains or reactivation remains. Users who may have interacted with this domain should immediately change their GoDaddy passwords and enable two-factor authentication. For ongoing verification, PhishDestroy recommends cross-referencing any suspicious URLs against its database and remaining vigilant against email or social media messages urging login to third-party sites. Always navigate directly to GoDaddy's official website rather than clicking on links in unsolicited communications.