site-ijt5hnn61[.]godaddysites[.]com

On July 23, 2026 analysts observed that the domain site-ijt5hnn61.godaddysites.com is currently taken offline and returns an HTTP 404 response. The domain was created on November 18, 2013 and is registered through GoDaddy.com, LLC, using GoDaddy’s default nameservers cns1.secureserver.net and cns2.secureserver.net. The site presents a TLS certificate issued to GoDaddy.com, Inc. by the Go Daddy Secure Certificate Authority – G2, confirming the use of a standard GoDaddy SSL offering. DNS resolution points to the IP address 13.248.243.5, which belongs to Amazon.com, Inc. (AS16509) and is located in the United States.

VirusTotal analysis shows that sixteen of ninety‑five security vendors flagged the domain, indicating a modest detection rate across scanning engines. The domain appears on a single public blocklist and is explicitly blocked by the PhishDestroy service, reinforcing its classification as a brand‑impersonation site targeting BT. The page title retrieved from the site is simply "BT," matching the declared brand target.

While the domain’s offline status and 404 response prevent direct observation of malicious content, the combination of vendor detections, blocklist presence, SSL issuance, and hosting details suggests an active impersonation campaign that may have been recently taken down or is in a staging phase. Defenders should continue to monitor the domain’s DNS records for any re‑activation, enforce outbound filtering for connections to the associated IP range, and add the domain to internal blocklists. Additional scrutiny of related godaddysites.com subdomains and any future TLS certificates issued by GoDaddy for similar patterns is recommended to pre‑empt potential resurrection of the impersonation effort.