sso-uphweld[.]framer[.]media

This domain, sso-uphweld.framer.media, is flagged for high-risk brand impersonation targeting cryptocurrency users through a fraudulent Uphold login portal. Analysis indicates the page mimics the legitimate Uphold trading platform, presenting itself as a 'Simple Crypto Trading Platform' to deceive victims into entering credentials or transferring assets. The threat type is classified as brand impersonation, with no evidence of a crypto drainer kit at this stage, though credential theft remains the primary objective. Infrastructure analysis reveals the domain resolves to the IP address 31.43.161.6, hosted under a Let's Encrypt SSL certificate to lend an air of legitimacy. VirusTotal detection metrics show 2 out of 95 security vendors have flagged this domain as malicious, a relatively low but concerning ratio given the domain's active status. The registrar for framer.media is Namecheap, Inc., though no precise domain creation date for the subdomain sso-uphweld.framer.media is publicly available. Google Safe Browsing (GSB) status remains unconfirmed, and no additional blocklist entries beyond VirusTotal have been identified at this time. As of the latest verification, the domain remains active and continues to host the fraudulent Uphold login page. No takedown actions have been observed, and the threat actor's infrastructure appears operational. Users are advised to treat any interaction with this domain as malicious, particularly those redirected from unsolicited communications or advertisements. Organizations should update web filters to block the domain and IP, while individuals should verify the authenticity of crypto trading platforms through official channels before entering credentials. The remaining risk is assessed as high due to the domain's active status and targeted impersonation of a well-known cryptocurrency service.