upohold-logiinus[.]godaddysites[.]com

This domain, upohold-logiinus.godaddysites.com, poses an elevated threat of brand impersonation, specifically targeting GoDaddy users. The site mimics the appearance and functionality of a legitimate GoDaddy login page, aiming to deceive users into revealing sensitive information such as usernames, passwords, and personal details. This type of phishing attack can lead to unauthorized access to user accounts and potential financial or identity theft.

Analysis indicates that the domain was created on November 18, 2013, and is registered through GoDaddy.com, LLC. The domain resolves to the IP address 76.223.105.230, which is located in the United States under the AS16509 network operated by Amazon.com, Inc. The SSL certificate is issued by GoDaddy.com, Inc. through the Go Daddy Secure Certificate Authority - G2. VirusTotal reports that 20 out of 95 security vendors flag this domain as malicious, and it appears on two security blocklists, including PhishDestroy and PhishingDB. The domain is currently offline, indicating that it has been taken down or is no longer active.

If a user has visited upohold-logiinus.godaddysites.com, it is crucial to take immediate action to ensure account security. First, the user should change their GoDaddy account password and enable two-factor authentication if not already active. It is also advisable to monitor the account for any unauthorized activities and to review recent transactions. Users should report the incident to GoDaddy's support team and consider running a full system scan for malware to ensure that no additional threats have been installed on their device.