site-vkcvj8dov[.]godaddysites[.]com

This domain, site-vkcvj8dov.godaddysites.com, is flagged as a brand impersonation threat targeting BT, a telecommunications provider. Analysis indicates the site presents a fraudulent login interface under the page title 'BT,' designed to deceive users into submitting credentials or sensitive account details. No evidence of a drainer kit or cryptocurrency wallet interaction was observed, suggesting a focus on traditional credential harvesting. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on February 21, 2026, and resolves to the IP address 13.248.243.5, hosted on Amazon.com, Inc. infrastructure (AS16509). Detection metrics show 21 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by GoDaddy.com, Inc., under the Go Daddy Secure Certificate Authority - G2, which does not mitigate the underlying threat. No Google Safe Browsing (GSB) listing was recorded at the time of analysis. The domain has since been taken offline, likely following detection and reporting. However, the elevated risk classification persists due to the domain's recent activity and the potential for infrastructure reuse. Users who interacted with the site are advised to reset credentials, monitor accounts for unauthorized access, and verify communications from the legitimate service provider. Organizations should update blocklists to include the domain and associated IP to prevent future exposure.