site-i6lkpfist[.]godaddysites[.]com

This domain, site-i6lkpfist.godaddysites.com, is identified as a brand impersonation phishing resource targeting BT, a telecommunications provider. The site presents itself as an official BT portal, likely designed to harvest user credentials, payment details, or other sensitive information under false pretenses. Analysis indicates the page title explicitly displays 'BT,' reinforcing the intent to deceive visitors into believing they are interacting with a legitimate service endpoint. The threat leverages social engineering tactics to exploit trust in the targeted brand, increasing the likelihood of successful compromise for unsuspecting users. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on February 21, 2026, and is currently offline. It appears on one security blocklist and has been flagged by 17 out of 95 security vendors on VirusTotal, indicating elevated risk. The domain resolves to the IP address 13.248.243.5 and employs an SSL certificate issued by GoDaddy.com. Detected technologies include GoDaddy Website Builder, RequireJS, Cloudflare, Re:amaze, HSTS, and cdnjs, suggesting the use of commercial hosting and content delivery infrastructure to enhance the site's appearance of legitimacy. The Gridinsoft trust score of 0/100 further corroborates the malicious classification. Users who accessed this domain should immediately revoke any entered credentials, particularly those associated with BT accounts or linked financial services. It is recommended to monitor accounts for unauthorized activity, enable multi-factor authentication where available, and report the incident to the targeted organization’s security team. System scans using updated security tools are advised to detect potential secondary infections or data exfiltration. Organizations should update internal blocklists to include this domain and its associated IP to prevent future access attempts.