site-vfxtd3yx9[.]godaddysites[.]com

Analysis of site-vfxtd3yx9.godaddysites.com indicates that the domain is currently offline but retains evidence of credential phishing activity. The domain was created on November 18, 2013 and is registered through GoDaddy.com, LLC, using the nameservers cns1.secureserver.net and cns2.secureserver.net. Infrastructure examination shows the domain resolves to IP address 13.248.243.5, which belongs to Amazon.com, Inc. (AS16509) and is located in the United States. The site presented an SSL certificate issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2, confirming the use of a legitimate certificate authority despite malicious intent.

HTTP probing returned a 404 status code, suggesting that the malicious page has been removed or is no longer accessible. VirusTotal scans recorded 15 detections out of 95 security vendors, and the domain appears on a single security blocklist, where it was flagged by PhishDestroy. The page title captured from prior observations reads "srvicehtmlplogin," which aligns with the credential phishing classification.

While the current offline status limits immediate threat exposure, the historical presence of phishing indicators warrants continued monitoring. Defenders should maintain the domain on blocklists, enforce DNS filtering for the associated IP range, and consider updating detection signatures to capture the observed page title pattern. Ongoing vigilance is recommended to detect any potential reactivation or reuse of the infrastructure for future credential harvesting campaigns.