site-wnsnhna8w[.]godaddysites[.]com

This domain is identified as a fraudulent Sunrise mail login portal designed to harvest user credentials through brand impersonation. The page title, Sunrise mail, mimics a legitimate email service provider, presenting a fabricated login interface to deceive visitors into submitting their account details. Such credential harvesting campaigns are commonly used to gain unauthorized access to personal or corporate email accounts, enabling further malicious activities such as data exfiltration, financial fraud, or lateral movement within compromised networks. Analysis indicates the domain was registered through GoDaddy.com, LLC on February 21, 2026, and resolves to the IP address 13.248.243.5, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). The domain appears on one security blocklist and is flagged by 20 out of 95 security vendors on VirusTotal, confirming its malicious classification. The SSL certificate, issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2, does not mitigate the threat, as phishing domains frequently employ valid certificates to appear legitimate. Users who have visited site-wnsnhna8w.godaddysites.com or entered credentials on the page should immediately change their Sunrise mail account password and enable multi-factor authentication if available. All devices used to access the domain should undergo a security scan to detect potential malware or unauthorized access. Additionally, affected users should monitor their accounts for suspicious activity, such as unauthorized logins or sent messages, and report any anomalies to their email service provider. Organizations should update their security policies to block access to this domain and similar infrastructure to prevent further exposure.