uphloll-xlugnm-io[.]godaddysites[.]com

Analysis of uphloll-xlugnm-io.godaddysites.com indicates a high‑risk generic phishing operation that remains active as of the report date, July 25, 2026. VirusTotal records show that 14 of 91 security vendors have flagged the domain, providing a clear multi‑engine consensus that the site is malicious. The domain was registered through GoDaddy.com, LLC, a widely used registrar, and resolves to the IPv4 address 13.248.243.5. No nameserver information is available, which limits deeper DNS‑based attribution.

The domain is listed on one public security blocklist and has been specifically blocked by the PhishDestroy mitigation service, confirming that external threat‑intelligence feeds consider it a phishing threat. The current status is still active, meaning the site continues to serve content that may be used to harvest credentials or other sensitive data. Because the hosting IP belongs to a shared GoDaddy infrastructure, the malicious page may be hosted alongside legitimate sites, complicating takedown efforts.

Defenders should immediately add uphloll-xlugnm-io.godaddysites.com to URL filtering and DNS block policies, monitor outbound connections to 13.248.243.5 for potential exfiltration, and consider sinkholing the IP if feasible. Continuous re‑evaluation is advised, as the lack of nameserver data and limited public intelligence leaves some aspects of the infrastructure uncertain. Ongoing vigilance, combined with cross‑vendor detection updates, will reduce exposure to this high‑confidence phishing vector.