site-drq1z8cp0[.]godaddysites[.]com

This domain, site-drq1z8cp0.godaddysites.com, was identified as a brand impersonation threat targeting Orange, a telecommunications provider. The page title 'Orange-Mobile' and domain structure suggest an attempt to deceive users into believing they are interacting with an official Orange service, likely for credential harvesting or account takeover purposes. The domain was designed to mimic legitimate mobile service portals, increasing the likelihood of successful social engineering attacks against Orange customers.

Analysis indicates the domain resolved to IP 76.223.105.230, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). It was registered through GoDaddy.com, LLC on November 18, 2013, though the malicious activity appears to have been recent. Security vendors on VirusTotal flagged the domain at a rate of 18/95, and it appeared on one security blocklist prior to being taken offline. The SSL certificate was issued by GoDaddy.com, Inc., which is consistent with the registrar but does not mitigate the malicious intent of the domain.

Users who visited site-drq1z8cp0.godaddysites.com should assume their credentials or personal information may have been compromised. Immediate actions include resetting passwords for Orange accounts and any other services where the same credentials were reused. Monitoring for unauthorized transactions or account activity is recommended. If financial or sensitive data was entered, affected individuals should report the incident to relevant authorities and consider credit monitoring services. Organizations should update their security controls to block this domain and its associated IP to prevent further exposure.