page--auth-uphold-sso[.]weebly[.]com

The domain page--auth-uphold-sso.weebly.com was registered on March 29, 2006 through MarkMonitor Inc. and currently resolves to the IPv4 address 74.115.51.8. Its authoritative name servers are ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, and ns-646.awsdns, indicating reliance on Amazon Web Services DNS infrastructure. The domain appears on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reflecting consensus among anti‑phishing platforms that the site is being used for malicious purposes.

Google Safe Browsing classifies the site under the social engineering category, reinforcing the suspicion of credential‑stealing activity. VirusTotal scans have resulted in 18 of 91 security vendors flagging the domain, demonstrating a significant detection rate across independent scanners. The threat is cataloged as a generic phishing operation with a high risk rating and an active status as of the report date, July 29, 2026.

While the specific brand or credential target is not disclosed in the available intelligence, the combination of blocklist listings, Safe Browsing flag, and multi‑vendor detections suggests the domain is being leveraged to harvest user credentials or other sensitive data. Defenders should continue to block the domain at network perimeter devices, update DNS filtering rules to include its IP and name server ranges, and monitor for any outbound connections to 74.115.51.8. Incident response teams should also consider adding the domain to internal watchlists and correlating any login attempts or credential submissions originating from this host with potential compromise events.