site-yfk6z2fjb[.]godaddysites[.]com

PhishDestroy has identified a brand impersonation campaign targeting BT customers through the domain site-yfk6z2fjb.godaddysites.com. This phishing domain was designed to mimic the official BT login page, aiming to steal user credentials through a fake authentication portal. No specific crypto drainer kit was associated with this threat, but the fraudulent site leveraged a GoDaddy-issued SSL certificate to appear legitimate.

Technical analysis reveals that the domain was created on February 21, 2026, and resolves to IP address 13.248.243.5. It was registered through GoDaddy.com, LLC and is currently flagged by 16 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist, and Google Safe Browsing status was not explicitly provided, though the elevated risk level and offline status indicate active monitoring.

As of the latest update, the domain has been taken offline, mitigating immediate risk to users. However, similar variants may emerge, and PhishDestroy recommends that BT customers always verify login URLs through official channels. Users who may have interacted with this site should change their credentials and enable multi-factor authentication immediately.