site-m71481kq3[.]godaddysites[.]com

The domain site-m71481kq3.godaddysites.com is registered through GoDaddy.com, LLC and uses the cns1.secureserver.net and cns2.secureserver.net nameservers. It resolves to the IP address 13.248.243.5, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site presents an SSL certificate issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2, indicating that TLS termination is provided by the registrar rather than the malicious operator. The page title observed during analysis was "messagerie.orange," directly referencing the targeted brand Orange.

VirusTotal scans have flagged the domain on 13 of 95 security vendors, suggesting a consensus of malicious intent among detection engines. The domain is currently listed on one security blocklist and has been explicitly blocked by PhishDestroy, reinforcing its classification as a brand‑impersonation threat. HTTP probing returned a 404 status, indicating that the original content may have been removed or the site is temporarily offline; however, the historical presence of a brand‑specific title and the detection counts imply prior active use. The domain was created on 18 November 2013, which demonstrates that the infrastructure may be part of a longer‑standing campaign that reuses legacy domains.

Defenders should continue to enforce outbound filtering for the domain and its resolved IP, incorporate the domain into internal blocklists, and monitor for new subdomains under the godaddysites.com platform that reference Orange or similar brand identifiers. Given the Amazon hosting, any future content could be rapidly provisioned, so threat‑intel feeds should be consulted for re‑activation alerts. Organizations should also audit email gateways for messages containing links to this domain or similar patterns, and consider sharing the indicator with industry‑wide threat‑sharing platforms to aid collective remediation.