paydefi[.]app

The domain paydefi.app is currently flagged as an active brand impersonation threat targeting GoDaddy, with a high risk classification as of July 12, 2026. Infrastructure analysis reveals the domain resolves to the IP address 76.223.105.230, hosted on infrastructure associated with ASN 16509. It has been detected in 23 threat intelligence pulses, indicating widespread recognition within the security community as malicious. The domain appears on two security blocklists and is actively blocked by at least two detection systems, further corroborating its malicious status. Technical indicators show the domain employs GoDaddy Website Builder, RequireJS, reCAPTCHA, and HSTS, suggesting an attempt to appear legitimate while potentially evading automated detection. The page title, matching the domain name itself, offers no additional context about the content or specific fraudulent scheme being perpetrated. While four out of 95 security vendors on a multi-engine scanning platform have flagged the domain, the exact nature of the phishing content remains unconfirmed due to the absence of deeper content analysis. The domain's registration through a known provider and its continued operational status present an ongoing risk to users. Defenders should prioritize blocking the domain and its associated IP address at the network level, particularly in environments where GoDaddy services are utilized. Monitoring for related domains or subdomains using similar naming conventions or infrastructure is recommended, as threat actors frequently rotate domains to evade detection. Given the domain's presence in multiple threat intelligence feeds, organizations should cross-reference internal logs for any connections to this infrastructure to identify potential compromises or targeted users.