upp-hnolldd-llogg[.]godaddysites[.]com

This domain, upp-hnolldd-llogg.godaddysites.com, is actively flagged as a high-risk brand impersonation phishing site targeting GoDaddy users. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on November 18, 2013, and currently resolves to IP address 13.248.243.5, hosted on Amazon.com, Inc. (AS16509) in the United States. The nameservers (cns1.secureserver.net and cns2.secureserver.net) and SSL certificate (issued by GoDaddy.com, Inc. / Go Daddy Secure Certificate Authority - G2) align with legitimate GoDaddy infrastructure, which may increase the site's perceived authenticity to potential victims. The page title, 'Uphōld Lōgiṇ,' contains non-standard Unicode characters, a common tactic to evade basic detection mechanisms while visually mimicking a login portal. The domain is detected by 16 of 95 security vendors on VirusTotal, and it appears on two security blocklists, including PhishDestroy and PhishingDB. Gridinsoft assigns a trust score of 0/100, further indicating malicious intent. Technologies detected include GoDaddy Website Builder, RequireJS, and HSTS, suggesting the use of a templated phishing kit hosted on GoDaddy's platform. While the domain's creation date predates the current phishing activity, this is not uncommon for repurposed domains. The HTTP status code 200 confirms the site is currently active and serving content. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where GoDaddy services are in use. Additional monitoring of related subdomains under godaddysites.com is recommended, as this infrastructure may be leveraged for further phishing campaigns. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, SSL legitimacy, and active blocklist presence warrants immediate mitigation.