17i[.]70b[.]myftpupload[.]com

The domain 17i.70b.myftpupload.com was observed on July 24, 2026 and is classified as a brand‑impersonation threat targeting Facebook. The site is hosted behind Cloudflare infrastructure (AS13335) and resolves to the IPv4 address 172.65.161.251, an IP range associated with Cloudflare, Inc. The domain was registered on February 21, 2026 through Wild West Domains, LLC and utilizes the authoritative nameservers ns01.myftpupload.com and ns02.myftpupload.com. No TLS certificate was present at the time of analysis, and an HTTP request returned a 404 status code, indicating that the expected content was not served. The page title returned by the server is "My WordPress Site -", which provides no indication of malicious intent but also offers no legitimate context.

VirusTotal scans reported that eight of ninety‑three security vendors flagged the domain, suggesting a modest level of detection across the ecosystem. Google Safe Browsing categorised the address as a social‑engineering threat, and the domain appears on a single security blocklist. Independent assessment from Gridinsoft assigned the site a trust score of 0 out of 100, reinforcing the suspicion of malicious use. The domain has been taken offline and is listed as blocked by the PhishDestroy service.

Because the site no longer serves content, any active phishing payload cannot be captured, yet the infrastructure remains observable. Defenders should continue to block the IP address 172.65.161.251 and the domain name itself at DNS and proxy layers, monitor for any re‑registration attempts, and update endpoint protection signatures to reflect the eight VirusTotal detections. Additional scrutiny of other subdomains under the myftpupload.com hosting provider may be warranted, as the provider is frequently abused for similar campaigns.