secure-uphold-secure[.]square[.]site

Analysis of secure-uphold-secure.square.site indicates that the domain was employed for credential phishing and is currently offline. The site was secured with a Let’s Encrypt certificate (issuer E7) and was hosted on Amazon Web Services while also utilizing Cloudflare services, suggesting a layered infrastructure designed for resilience. Registration was performed through MarkMonitor, Inc., and the domain was created on February 5, 2019. DNS resolution points to IP address 74.115.51.5, which belongs to AS27647 Weebly, Inc. and is geolocated in the United States.

The authoritative name servers are ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, and ns-810.awsdns, all consistent with AWS DNS routing. HTTP inspection returned a 404 status and the page title "Nur einen Moment…", indicating that the content was either removed or never served a valid response before takedown. The domain appears on one security blocklist and has been flagged by PhishDestroy, confirming its malicious classification. VirusTotal analysis recorded 11 detections out of 95 security vendors, reinforcing the presence of malicious activity.

Although the site is no longer reachable, defenders should continue to block the associated IP address and monitor any future registrations of the same name or similar pattern. Network‑level controls should deny traffic to the identified name servers and the IP range associated with AS27647. Continuous surveillance of the registrar and certificate issuance patterns is advised to detect potential re‑use of the infrastructure for new phishing campaigns.