site-aic91fv1h[.]godaddysites[.]com

This domain, site-aic91fv1h.godaddysites.com, is flagged for brand_impersonation targeting BT, a telecommunications provider. The threat actor constructed a fraudulent service portal mimicking BT's official web infrastructure, as evidenced by the page title 'BT' and visual elements consistent with the legitimate brand. No specific drainer kit signatures were identified in initial analysis, though the domain exhibits characteristics typical of credential harvesting and account takeover campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through GoDaddy.com, LLC, and resolves to IP address 13.248.243.5, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain appears on one security blocklist and is flagged by 22 out of 95 security vendors on VirusTotal. The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2, providing a superficial layer of legitimacy. No detections were reported on Google Safe Browsing at the time of analysis. The domain has been taken offline, likely in response to detection by security systems. However, the elevated risk persists due to the domain's recent creation date and the potential for threat actors to re-deploy similar infrastructure. Organizations and users are advised to monitor for additional domains registered through the same registrar or resolving to the identified IP range. Network defenders should implement retrospective analysis to identify any prior interactions with the domain and update detection rules to account for variations in domain naming patterns associated with this campaign.