sso--uphold----com---cdnn---auth-en-us[.]webflow[.]io

The domain sso--uphold----com---cdnn---auth-en-us.webflow.io is currently offline, returning an HTTP 404 status, yet it remains listed in threat intelligence feeds as a credential phishing site targeting Uphold users. Registration data shows the domain was created on May 08, 2013 and is managed through MarkMonitor, Inc., a registrar often used for brand‑related domains. The name resolves to the IP address 172.64.151.8, which belongs to Cloudflare (AS13335) and is located in the United States. DNS resolution uses Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and the site serves an SSL certificate issued by Google Trust Services under the WE1 profile, indicating a valid TLS handshake despite the site being taken down. Technical fingerprints reveal the use of Cloudflare's HTTP/3 protocol, confirming modern content delivery network (CDN) infrastructure.

VirusTotal reports indicate that 15 of 95 security vendors have flagged the domain, and it appears on at least one external blocklist, with PhishDestroy already marking it as blocked. The page title captured in prior crawls reads "Log In | Uphold® – Sign In to Your Account," directly referencing the legitimate Uphold brand and reinforcing the credential‑phishing intent. No additional malware families, payloads, or secondary infrastructure have been observed in the available data.

Defenders should continue to block the domain at network perimeters and update URL filtering rules to include the full hostname. Security operations teams should monitor for any resurgence of the site, especially if the 404 page is replaced with a live login clone, and should verify that any user‑reported attempts to access the URL are routed to safe browsing warnings. Given the registrar, CDN host, and SSL provider, takedown requests may be limited in effectiveness, so emphasis on detection and user education remains critical.