mypuolas[.]live

The domain mypuolas.live was first observed on February 22, 2026 and is registered through NiceNIC International Group Co., Limited. DNS resolution points to the Cloudflare‑owned address 172.67.207.247, which belongs to AS13335 and is geolocated in the United States. The authoritative nameservers are piotr.ns.cloudflare.com and kenia.ns.cloudflare.com, and the site serves content over Cloudflare’s HTTP/3 stack with a TLS certificate issued by Google Trust Services under the WE1 intermediate. The landing page title reads “Your Subscription Expired,” a common lure used in credential‑ harvesting campaigns.

VirusTotal analysis recorded three positive detections out of ninety‑five scanners, and the domain appears on a single external blocklist. PhishDestroy has also listed the site as malicious, while Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the elevated risk rating. The site’s current status is offline, limiting immediate observation, and no additional payload or redirect behavior has been publicly disclosed.

Given the concrete indicators—registration data, Cloudflare hosting, TLS details, page title, vendor detections, and blocklist entries—defenders should treat the indicator as hostile. Recommended actions include adding the domain to URL filtering policies, updating intrusion‑prevention signatures with the observed IP and certificate fingerprint, and monitoring for newly registered Cloudflare‑hosted domains that exhibit similar characteristics. Continuous enrichment of threat feeds with these attributes will aid in early detection of campaigns that reuse the same infrastructure.