sfrmail2[.]godaddysites[.]com

Analysis of sfrmail2.godaddysites.com shows multiple indicators of abuse consistent with a generic phishing operation. The domain was registered on February 21, 2026 through GoDaddy.com, LLC and is secured with a Go Daddy Secure Certificate Authority - G2 SSL certificate issued by GoDaddy.com, Inc. DNS resolution points to IP address 13.248.243.5, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. HTTP requests return a 404 Not Found status and the page title returned by the server is also "404 Not Found," indicating that the site is currently offline.

Despite the offline state, the domain appears on one public security blocklist, specifically PhishDestroy, and has been flagged by 15 of 93 security vendors on VirusTotal, reinforcing the suspicion of malicious intent. The presence of a valid SSL certificate suggests an attempt to lend credibility to the site, a common technique in phishing campaigns. At present, the exact payload, targeted brand, or phishing kit employed cannot be confirmed because the site content is unavailable.

Defenders should continue to block the domain at perimeter defenses, monitor for any re‑activation or DNS changes, and correlate any future traffic to the associated Amazon‑hosted IP with existing threat intelligence. Ongoing observation of the registrar and certificate details is advised to detect potential repurposing of the domain for new malicious campaigns.