site-viliyjq9h[.]godaddysites[.]com

Analysis of site-viliyjq9h.godaddysites.com shows that the domain is currently offline and served a 404 HTTP response when accessed. The site was registered on November 18, 2013 through GoDaddy.com, LLC and is hosted on an Amazon-owned address (13.248.243.5) associated with AS16509, confirming that the infrastructure resides in the United States. DNS resolution points to GoDaddy’s default nameservers cns1.secureserver.net and cns2.secureserver.net, and the TLS certificate presented is a GoDaddy Secure Certificate Authority - G2 issuance, which is typical for domains using GoDaddy’s hosting platform. VirusTotal scans reveal that twelve of ninety‑five security vendors flagged the domain, indicating a modest detection rate across reputable scanners.

The domain has been listed on a single public blocklist and was actively blocked by the PhishDestroy service, reinforcing the view that it was being used for malicious purposes. The page title returned by the server, "zdefrg," provides no indication of the targeted brand or service, and no further content was captured before the site was taken offline. Consequently, the precise phishing lure and any associated credential‑stealing mechanisms remain undefined.

Defenders should continue to monitor the IP address 13.248.243.5 for any resurgence of malicious activity, enforce blocklist rules that already reference this host, and consider adding the domain to internal deny lists. Because the TLS certificate is a standard GoDaddy issuance, reliance on certificate attributes alone is insufficient for detection; instead, correlation with the observed 404 response, blocklist presence, and the twelve vendor flags should form the basis of detection logic. Ongoing vigilance is recommended, especially for any future subdomains or services launched from the same registrar or hosting provider that might replicate this pattern.