auth---uphold-cdn-login[.]weebly[.]com

The domain auth---uphold-cdn-login.weebly.com is currently active and classified as a credential phishing site. Registration data shows it was created on March 29, 2006 and is registered through MarkMonitor, Inc., a registrar often associated with high‑value brand protection services. The authoritative name servers are ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, and ns-646.awsdns, indicating the domain is hosted on Amazon’s Route 53 DNS infrastructure. DNS resolution points to the IPv4 address 74.115.51.8, which is the sole host observed for this domain.

Multiple security‑focused services have taken action against the domain: PhishDestroy, MetaMask, and SEAL have all listed it as blocked, and it appears on three independent security blocklists. Google Safe Browsing has flagged the domain for social engineering, reinforcing the phishing classification. VirusTotal analysis shows that 18 of 91 scanning engines have flagged the domain, demonstrating a moderate to high level of consensus among detection vendors. The available evidence confirms that the domain is being used to harvest credentials, but the specific target brand, page title, or phishing kit employed has not been disclosed in the current intelligence set.

Consequently, defenders cannot attribute the site to a particular victim demographic beyond the generic credential‑theft motive. Given the confirmed malicious infrastructure, security teams should enforce network‑level blocks for the domain and its resolved IP address, add the domain to local and cloud‑based URL filtering policies, and monitor for any outbound connections to the host. Incident response teams should also consider scanning for related indicators of compromise, such as traffic to the listed Amazon name servers or any payloads that reference the domain’s URL pattern.