receivepayments[.]com

Analysis shows that receivepayments.com is an active domain used for brand impersonation of GoDaddy. The site presents a valid SSL certificate issued to GoDaddy.com, Inc. and is served over HTTPS with HSTS, but the certificate alone does not validate the legitimacy of the content. Infrastructure inspection reveals the domain resolves to IP 23.56.162.17, hosted within AS16625 Akamai Technologies in the United States, and the web stack includes Node.js, Envoy, and Express behind an Akamai edge. VirusTotal records indicate that two of ninety‑three scanning engines have flagged the site, and Gridinsoft assigns a trust score of zero out of one hundred, indicating a high likelihood of malicious intent. The domain is listed on a single security blocklist and has been blocked by PhishDestroy, confirming external detection of abuse. Registration information shows the domain was created on 26 October 2003 through Wild West Domains, LLC, and continues to use afternic.com name servers, suggesting no recent ownership change. No mail exchange records are published, and the MX array is empty, limiting email‑based abuse but not preventing credential harvesting via the web interface. Defenders should add the IP address and domain to network deny lists, monitor TLS connections for the GoDaddy certificate presented by an unexpected host, and enforce strict outbound filtering to block HTTP/HTTPS traffic to this endpoint. Continuous re‑assessment is recommended, as the site’s content has not been publicly analyzed and further malicious payloads could be introduced.