site-9gzodesty[.]godaddysites[.]com

This domain, site-9gzodesty.godaddysites.com, is flagged for brand impersonation targeting GoDaddy, a well-known domain registrar and hosting provider. Analysis indicates the threat type is credential harvesting, specifically masquerading as a Microsoft email portal, as evidenced by the page title 'VotreCourrielMicrsoft.' The domain does not appear to be associated with a known drainer kit but is designed to deceive users into divulging login credentials by mimicking legitimate services. Infrastructure analysis reveals the domain resolves to the IP address 13.248.243.5, hosted on Amazon.com, Inc. infrastructure (AS16509). The domain was registered on November 18, 2013, through GoDaddy.com, LLC, and is currently associated with an SSL certificate issued by Go Daddy Secure Certificate Authority - G2. Detection metrics show 20 out of 95 security vendors on VirusTotal have flagged this domain as malicious. It appears on one security blocklist and was actively blocked by PhishDestroy prior to being taken offline. As of the latest assessment, the domain has been rendered offline, reducing immediate exposure risks. However, residual threats persist due to the domain's historical use in credential harvesting campaigns. Organizations and users are advised to monitor for any reactivation attempts and validate SSL certificates when accessing legitimate services. Network defenders should update blocklists to include this domain and its associated IP address to mitigate potential future misuse. Vigilance is recommended, particularly for users who may have interacted with the domain during its active period.