m-uphold-sso[.]framer[.]ai

The domain m-uphold-sso.framer.ai is classified as a high-risk social engineering phishing threat. This domain is designed to deceive users into entering sensitive information, such as login credentials, by mimicking the appearance of a legitimate login page for the Uphold service.

This domain is flagged by 12 out of 95 security vendors on VirusTotal, indicating a moderate level of detection but also suggesting that it may evade some security measures. The domain is registered through CSC Corporate Domains, Inc., and resolves to the IP address 31.43.160.6. It was created on January 06, 2018, and currently appears on three security blocklists. The SSL certificate used is from Let's Encrypt, which can lend a false sense of security to users. Google Safe Browsing has flagged the domain for social engineering, further corroborating its malicious nature. The domain is also blocked by MetaMask, PhishDestroy, and SEAL, which are known for their robust threat detection capabilities.

To mitigate the risks associated with this social engineering phishing threat, users are advised to verify the URL and SSL certificate of any login page they visit, especially for financial services. Security teams should update their blocklists and ensure that network security policies are enforced to prevent access to this domain. Additionally, educating users about the signs of phishing attacks and implementing multi-factor authentication (MFA) can significantly reduce the likelihood of successful credential theft.