yahoomail2[.]godaddysites[.]com

This investigation documents the phishing infrastructure associated with yahoomail2.godaddysites.com. The domain was registered through GoDaddy.com, LLC on November 18, 2013 and continues to resolve to the IPv4 address 13.248.243.5. The authoritative name servers are cns1.secureserver.net and cns2.secureserver.net, both operated by GoDaddy’s DNS service.

VirusTotal analysis shows that 14 of 91 security vendors flag the domain as malicious, indicating a moderate consensus of detection across scanners. The domain is listed on a public security blocklist and is actively blocked by the PhishDestroy mitigation service, reinforcing its classification as a phishing resource. No additional public intelligence such as page title, SSL certificate details, or HTTP response codes is currently available, so the precise content and lure techniques remain unverified.

However, the combination of registrar information, DNS configuration, malicious detection count, and active blocklist presence suggests an operational phishing campaign targeting users who may be deceived by the “yahoomail2” sub‑domain naming pattern. Defenders should incorporate the domain and its resolving IP address into outbound and inbound filtering rules, monitor DNS queries for the associated name servers, and consider the domain for inclusion in internal blocklists. Continuous re‑evaluation is advised, as future changes to hosting or content could alter the threat profile.