site-3fejh9hgr[.]godaddysites[.]com

Analysis as of July 24 2026 indicates that the sub‑domain site-3fejh9hgr.godaddysites.com was used to host a phishing page titled “Anmeldung UPC Mail”. The domain is registered through GoDaddy.com, LLC and has been active since 18 Nov 2013. DNS resolution points to IP 13.248.243.5, which belongs to Amazon.com, Inc. (AS16509) and is located in the United States. The host is served behind GoDaddy’s default nameservers cns1.secureserver.net and cns2.secureserver.net, and the TLS certificate presented is a Go Daddy Secure Certificate Authority – G2 issued to GoDaddy.com, Inc., confirming the legitimate certificate chain but offering no protection against malicious content. The page was flagged by PhishDestroy and is listed on one security blocklist.

VirusTotal scans show that 13 of 93 antivirus or URL‑reputation engines flagged the domain, indicating a moderate detection rate. HTTP probing returned a 404 status code, and the current operational status is recorded as offline, suggesting the phishing page has been taken down. Nonetheless, the historical evidence of phishing activity remains relevant for threat‑intel correlation. Defenders should continue to monitor the IP address 13.248.243.5 for any re‑use in future campaigns, especially since the Amazon hosting environment is frequently leveraged for transient malicious infrastructure.

Existing blocklist entries should be maintained, and any outbound traffic to this host should be denied or logged. Because the domain’s registration details are publicly available and the SSL certificate is valid, reputation‑based filtering alone may not be sufficient; supplemental URL‑reputation checks and cross‑reference with the 13 VirusTotal detections are advisable. In environments where users may receive emails purporting to be from UPC, security awareness training should highlight the “Anmeldung UPC Mail” title as a known indicator of compromise. Continuous review of GoDaddy‑hosted sub‑domains for similar patterns is recommended.