site-o39sgfxh7[.]godaddysites[.]com

The domain site-o39sgfxh7.godaddysites.com is identified as a credential theft operation specifically targeting users of Sunrise Mail. Analysis confirms the domain is currently offline, though it previously hosted a fraudulent login portal designed to harvest email credentials. The threat type is classified as credential theft, with the impersonated brand being Sunrise Mail, a known email service provider. Infrastructure analysis reveals the domain was flagged by 18 of 95 security vendors on VirusTotal, indicating a high likelihood of malicious activity. The domain was registered through GoDaddy.com, LLC on November 18, 2013, and resolves to the IP address 13.248.243.5, hosted on Amazon.com, Inc. infrastructure (AS16509). It appears on one security blocklist, and its SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2. The creation date suggests the domain may have been repurposed for malicious use, as its age does not align with typical phishing campaign timelines. Current status confirms the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, users who previously interacted with the site may remain at risk of credential compromise. Recommended actions include resetting passwords for any accounts accessed via this domain, enabling multi-factor authentication on all email services, and monitoring for unauthorized access. Organizations should update blocklists to include this domain and its associated IP address to prevent future exposure. The elevated risk level underscores the need for vigilance, particularly for users of Sunrise Mail or similar email platforms.