site-zvcrjz62s[.]godaddysites[.]com

Analysis of site-zvcrjz62s.godaddysites.com, created on February 21, 2026 and hosted on Amazon infrastructure (AS16509, IP 13.248.243.5, United States), shows a high‑risk brand‑impersonation campaign targeting BT. The site resolves via GoDaddy name servers cns1.secureserver.net and cns2.secureserver.net and presents a valid SSL certificate issued by Go Daddy Secure Certificate Authority - G2, indicating a legitimate‑looking HTTPS connection. An HTTP request returns status code 200, confirming the server is actively serving content. The page title is simply "BT", matching the declared brand target. Technical fingerprinting reveals the use of GoDaddy Website Builder, RequireJS, Re:amaze, and HTTP Strict Transport Security (HSTS), all common components of hosted builder platforms.

VirusTotal scans have flagged the domain in 23 of 93 security engines, and the domain appears on at least one public blocklist. It is also listed as blocked by PhishDestroy, and the Gridinsoft trust score is 0 out of 100, reinforcing the malicious classification. No additional intelligence such as malware payloads or phishing page screenshots is available, so the precise content and user‑interaction flow remain unverified. However, the convergence of brand impersonation, flagging by multiple vendors, a zero trust score, and active blocklist listings constitutes sufficient evidence for a high‑severity indicator.

Defenders should immediately add site-zvcrjz62s.godaddysites.com to URL filtering policies, enforce network‑level blocklists that include this domain, and consider sinkholing or isolating the hosting IP 13.248.243.5 to impede further abuse. Continuous monitoring of related GoDaddy name server resolutions and any future VirusTotal or phishing‑specific detections is recommended to capture potential pivot activity.