sign-upguld0n[.]godaddysites[.]com

The domain sign-upguld0n.godaddysites.com has been identified as a brand impersonation threat specifically targeting GoDaddy users through a crypto drainer scheme. Currently taken offline, this domain was designed to deceive visitors into believing they were accessing a legitimate GoDaddy service, but instead aimed to steal cryptocurrency credentials and drain digital wallets. The page title found on the site, 'Uphold | Login to my Account,' further indicates a phishing attempt mimicking a financial platform.

Technical analysis reveals that the domain was registered through GoDaddy.com, LLC and resolves to IP address 76.223.105.230. It was created on November 18, 2013, and has since appeared on two security blocklists. VirusTotal analysis shows that 16 out of 95 security vendors flagged this domain as malicious, highlighting its dangerous nature. The SSL certificate is issued by GoDaddy.com, Inc. / Go Daddy Secure Certificate Authority - G2, which adds a layer of apparent legitimacy but is misused for fraudulent purposes.

Given that the domain is now offline, the immediate risk has been mitigated; however, users who may have interacted with the site before takedown are urged to secure their accounts and monitor for suspicious activity. It is strongly recommended to avoid any unsolicited login prompts or links claiming to be from GoDaddy or Uphold, and to always verify URLs independently before entering credentials. Enabling multi-factor authentication and using unique passwords can further protect against similar threats.