site-rq5m5et7b[.]godaddysites[.]com

The domain site-rq5m5et7b.godaddysites.com is flagged for brand impersonation, specifically targeting the BT brand. This domain was designed to deceive users into believing they were interacting with legitimate BT services, potentially leading to credential theft or financial loss.

Analysis indicates that the domain has been flagged by 23 out of 95 security vendors on VirusTotal, suggesting a moderate level of consensus among security researchers regarding its malicious nature. The domain is registered through GoDaddy.com, LLC, and resolves to the IP address 13.248.243.5, which is located in the United States and is part of the AS16509 Amazon.com, Inc. network. The domain was created on February 21, 2026, and it appears on one security blocklist. The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2, which may have been used to add an air of legitimacy to the phishing attempt.

Currently, the domain is offline, which reduces the immediate risk to users. However, the infrastructure and techniques used in this campaign may still pose a threat if the domain is reactivated. Organizations and individuals should remain vigilant and ensure that their security measures, including DNS filtering and endpoint protection, are up-to-date to prevent any potential re-emergence of this threat. Additionally, users should be educated on recognizing brand impersonation tactics, such as verifying the URL and domain name, and avoiding clicking on suspicious links, especially those received via email or messaging platforms.