site-l5jj1e8n0[.]godaddysites[.]com

The domain site-l5jj1e8n0.godaddysites.com was registered on 21 February 2026 through GoDaddy.com, LLC. It resolves to the Amazon Web Services address 13.248.243.5, which is associated with ASN 16509 (Amazon.com, Inc.) and is located in the United States. The TLS certificate presented by the host is issued by Go Daddy Secure Certificate Authority – G2 and bears the GoDaddy.com, Inc. issuer name, indicating that the site relied on the registrar’s default SSL provisioning. An HTTP request to the root path returns a 404 status code, and the only visible page title captured is the single word “His”, providing no further context about the site’s purpose.

VirusTotal has recorded detections from 16 of 93 scanned security vendors, demonstrating that a notable minority of scanners consider the domain malicious. The domain is listed on one external security blocklist and has been actively blocked by the PhishDestroy service. Current monitoring shows the domain taken offline, and its status is reported as “offline”.

The available evidence confirms the presence of malicious indicators, yet the exact phishing payload, targeted brand, or victim‑interaction flow remains unknown because no landing page content or lure details have been disclosed. Defenders should continue to block the domain at perimeter and DNS layers, ensure that any cached DNS entries are purged, and monitor for any future re‑registration attempts or related sub‑domains that resolve to the same AWS IP range. Additional investigation should focus on retrieving historic snapshots of the site, analyzing the 16 vendor detections for specific signatures, and correlating any observed phishing emails with the domain’s creation timestamp to establish potential campaign timelines.