site-2xyv2b8yf[.]godaddysites[.]com

Analysis as of July 23, 2026 indicates that the domain site-2xyv2b8yf.godaddysites.com is currently offline but was previously used for a brand‑impersonation campaign targeting Orange. The domain was registered on February 21, 2026 through GoDaddy.com, LLC and uses GoDaddy’s default nameservers cns1.secureserver.net and cns2.secureserver.net. DNS resolution points to the IP address 13.248.243.5, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site presented an SSL certificate issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority – G2, confirming the use of a legitimate certificate authority but not providing any indication of malicious intent beyond the hosting choice.

Web probing returned an HTTP 404 status, and the page title captured during the brief availability was “Saisie de votre identifiant - ldentification orange”, directly referencing Orange and indicating a credential‑capture attempt. VirusTotal scans recorded 19 positive detections out of 93 security vendors, reinforcing the malicious classification. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy service, confirming its inclusion in active threat‑mitigation feeds.

The available evidence points to a classic brand‑impersonation vector, yet the exact content of the landing page and any additional payloads remain unverified because the site was taken offline before a full capture could be performed. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑hosting of the same host‑header or IP address, and consider adding the associated IP range to watchlists. Ongoing observation of GoDaddy‑registered domains that resolve to Amazon‑owned IPs and present SSL certificates from Go Daddy Secure Certificate Authority may help identify similar infrastructure in the future.