upholldlog[.]framer[.]website

Analysis of upholldlog.framer.website indicates that the site was provisioned on November 19 2021 through CSC Corporate Domains, Inc., and later hosted on Amazon Web Services (ASN 16509). DNS resolution points to 35.71.142.77 in the United States, and the authoritative name servers are ns-1243.awsdns-27.org, ns-1818.awsdns-35.co.uk, ns-336.awsdns-42.com, and ns-792.awsdns. The site presented the page title "Log In | Uphold* : | Sign In to Your Account" and was identified as a Tech Support Scam that impersonates Microsoft. TLS was supplied by Let’s Encrypt (certificate identifier E7) and the server advertised HSTS and HTTP/3, while fingerprinting of the front‑end stack revealed Framer Sites and React components.

An HTTP request returned a 404 status code, and the domain is presently taken offline. Security telemetry shows that PhishDestroy blocked the domain, and it appears on one additional security blocklist. VirusTotal analysis recorded 14 detections out of 95 scanning engines, reinforcing the malicious classification. No Safe Browsing or OTX entries were provided in the source data.

Given the convergence of registrar, hosting, TLS, and detection signals, the infrastructure should be added to network deny lists, and any outbound connections to the identified IP address should be monitored or terminated. Incident response teams should also audit for related sub‑domains under the same registrar or AWS account, and conduct threat‑intel correlation with other Microsoft‑impersonation campaigns. Continuous monitoring of DNS and certificate transparency logs is advised to catch re‑registrations or new front‑ends that reuse the same hosting profile.