sso-uphold--com---cdnn--auth-auth[.]webflow[.]io

The domain sso-uphold--com---cdnn--auth-auth.webflow.io is currently classified as a high‑risk generic phishing site. VirusTotal reports that 12 of 91 security vendors flag the domain as malicious, indicating a consensus among multiple scanners that the site is being used for deceptive activities. Google Safe Browsing corroborates this assessment by labeling the domain as a social engineering threat, which aligns with the generic phishing designation. Independent blocklists from PhishDestroy, MetaMask, and SEAL have also added the domain to their deny lists, and the domain appears on three additional security blocklists, reinforcing its malicious reputation across diverse threat‑intelligence sources.

The domain was registered through the Webflow hosting platform, a service commonly used for legitimate website creation but also occasionally leveraged by threat actors to obscure ownership. DNS resolution points to the IP address 104.18.36.248; this address is part of a cloud‑based content delivery network, which can facilitate rapid content distribution and hinder attribution. No nameserver records are available (NS_NOT_FOUND), limiting the ability to trace the authoritative DNS infrastructure.

While the available data confirms the domain’s malicious status, details such as the specific phishing landing page content, SSL certificate attributes, or HTTP response codes have not been disclosed, leaving those aspects of the threat surface uncertain. Defenders should immediately block the domain at network perimeters and endpoint security solutions, monitor DNS queries for the associated IP address, and consider adding the domain to internal blacklists. Continuous re‑evaluation is advised, as changes to hosting configuration or removal from blocklists could alter the threat profile.