site-20d62lmyo[.]godaddysites[.]com

This domain, site-20d62lmyo.godaddysites.com, was identified as a phishing threat targeting BT, a major telecommunications provider. The site was designed to impersonate legitimate BT services, likely aiming to harvest user credentials, payment details, or other sensitive information. Brand impersonation phishing campaigns like this exploit trust in well-known organizations to deceive victims into divulging confidential data, which can lead to financial loss or unauthorized account access. Analysis indicates the domain was created on February 21, 2026, and registered through GoDaddy.com, LLC. It resolved to the IP address 13.248.243.5, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). The SSL certificate was issued by GoDaddy.com, Inc., a common registrar for both legitimate and malicious domains. At the time of detection, the domain was flagged by 17 out of 95 security vendors on VirusTotal and appeared on one security blocklist, confirming its malicious nature. The page title explicitly referenced BT, reinforcing its intent to mimic the legitimate brand. If a user visited this domain or interacted with its content, immediate action is required to mitigate potential risks. First, any credentials entered on the site should be considered compromised and changed immediately across all platforms where the same or similar passwords were used. Users should also monitor their accounts for unauthorized transactions or suspicious activity. Enabling multi-factor authentication (MFA) on all critical accounts provides an additional layer of security. If financial information was submitted, contacting the relevant institution to report potential fraud is advised. Finally, scanning the device used to access the site with updated security tools can help detect any malware or unauthorized access attempts linked to the phishing campaign.