site-z09d9cvco[.]godaddysites[.]com

The domain site-z09d9cvco.godaddysites.com was registered through GoDaddy on 2026-02-21 and is currently taken offline, returning HTTP 404. It resolves to the Amazon-owned address 13.248.243.5 located in the United States and advertised under ASN AS16509 (Amazon.com, Inc.). The TLS certificate presented is issued by GoDaddy Secure Certificate Authority G2 and lists GoDaddy.com, Inc. as the subject. Nameserver records point to cns1.secureserver.net and cns2.secureserver.net, consistent with the registrar’s infrastructure.

VirusTotal analysis shows 16 of 93 scanning engines flag the host as malicious, and the domain appears on a single external blocklist, which has been incorporated into PhishDestroy’s feed. Gridinsoft assigns a trust score of 0 / 100, indicating a high confidence of abuse. Automated fingerprinting detected the GoDaddy Website Builder stack, RequireJS, Re:amaze, and HTTP Strict Transport Security (HSTS) headers. The page title returned is “BT”, matching the declared brand target BT, and the intelligence classification identifies the activity as a brand‑impersonation campaign aimed at BT.

Although the site currently returns a 404 and is reported as offline, the combination of low trust score, multiple vendor detections, and blocklist inclusion suggests the domain was used for malicious purposes and may be re‑activated in the future. Defenders should add the IP address 13.248.243.5 and the fully qualified domain name to outbound and inbound filtering rules, monitor DNS queries for this host, and ensure that any communications purporting to originate from BT are validated against known BT endpoints. Continuous re‑evaluation of the domain’s status is advised, as the infrastructure (GoDaddy hosting and Amazon cloud) is commonly reused by threat actors for rapid redeployment.