site-0m7nsn68e[.]godaddysites[.]com

This domain, site-0m7nsn68e.godaddysites.com, is confirmed to operate as a brand impersonation phishing site targeting GoDaddy customers. Analysis indicates the site was designed to mimic legitimate GoDaddy services, likely to harvest credentials, payment details, or other sensitive account information from unsuspecting users. The page title servievhtmpl6935 suggests the use of a templating system commonly associated with phishing kits, which may have been deployed to automate fraudulent activity at scale.

Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain resolves to IP address 76.223.105.230, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. VirusTotal reports 14 out of 95 security vendors flagging this domain as malicious, while it appears on two independent security blocklists. The domain was registered through GoDaddy.com, LLC on November 18, 2013, though the phishing content appears to have been deployed more recently. An SSL certificate issued by GoDaddy.com, Inc. provides a false sense of security, as the certificate authority is legitimate but the domain's content remains fraudulent.

Users who visited site-0m7nsn68e.godaddysites.com should immediately revoke any credentials entered on the site, particularly GoDaddy account logins or financial information. Monitor associated accounts for unauthorized activity and enable multi-factor authentication where available. Security teams should add this domain to internal blocklists and investigate any connections from corporate networks. The domain has been taken offline, but similar infrastructure may remain active. Review logs for interactions with the IP address 76.223.105.230 or domains containing the seed pattern 0m7nsn68e, as these may indicate related malicious activity.