sso-uphold-comauth-xx-auth[.]typedream[.]app

The domain sso-uphold-comauth-xx-auth.typedream.app was observed hosting a credential phishing page that mimics the login interface for the Uphold financial service, as indicated by the page title "Log In | Uphold®: | Buy & Sell Crypto & Metals*". The site resolves to the IP address 188.114.96.3, which belongs to AS13335 operated by Cloudflare, Inc., and the hosting location is identified as the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint at the time of capture. HTTP requests return a 403 status code, suggesting that the server is configured to deny unauthorized access or that the content is being restricted after detection. Technical fingerprints show a modern web stack: Node.js, React, Next.js, Google Cloud services (including Trace and CDN), Cloudflare, and Webpack, all of which are typical of legitimate web applications but also frequently leveraged by threat actors to host deceptive pages.

The domain appears on one public security blocklist and has been actively blocked by the PhishDestroy sink‑hole service. VirusTotal analysis recorded 13 positive detections out of 95 scanning engines, reinforcing the malicious classification. Registration details indicate the domain was provisioned through Cloudflare, Inc., and no separate nameserver records were found. Current status is offline, which may be a takedown or a temporary suspension by the hosting provider.

Uncertainty remains regarding the exact phishing kit used, the timeframe of initial deployment, and whether additional infrastructure (e.g., command‑and‑control servers) is associated with the same IP range. Defenders should add the domain and its resolving IP to blocklists, enforce DNS‑based filtering, and monitor for similar sub‑domains that reuse the "sso‑uphold" naming pattern.