en-us-sso--uphold--com----cdnn---auth[.]webflow[.]io

This domain is flagged as a credential harvesting phishing infrastructure designed to impersonate authentication portals. Analysis indicates the domain mimics legitimate single sign-on (SSO) endpoints, specifically targeting users of financial platforms through deceptive subdomain structures and path manipulation. The infrastructure leverages Cloudflare hosting, a common tactic to obscure origin servers and evade basic detection mechanisms while maintaining SSL encryption for perceived legitimacy. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered through NameCheap, Inc. on February 21, 2026, an anomalous future date suggesting potential registration data manipulation. Security vendors on VirusTotal flagged the domain at a ratio of 18/95, with detections spanning phishing, malicious URL, and fraud categories. The domain appears on one security blocklist and is currently offline, though historical resolution points to IP 172.64.151.8 (AS13335 Cloudflare, Inc.) with a Google Trust Services SSL certificate (WE1). The 404 page title further confirms recent activity prior to takedown. Users who visited this domain should immediately revoke any credentials entered, particularly those associated with financial services or SSO providers. Monitor accounts for unauthorized transactions or access attempts, and enable multi-factor authentication where available. Security teams should block the domain and associated IP at perimeter defenses, and review logs for connections to 172.64.151.8 during the active window. The anomalous creation date and SSL certificate details may serve as additional indicators for retrospective hunting in network telemetry.