portal-sso-uph-lod-cdn[.]netlify[.]app

Analysis of portal-sso-uph-lod-cdn.netlify.app shows that the domain is hosted on Netlify and resolves to the Amazon‑owned IP address 18.208.88.157 (AS14618). The TLS certificate presented is a DigiCert Global G2 RSA SHA256 2020 CA1 chain, and HTTP responses include an HSTS header, indicating the site was configured for secure transport. A request to the root URL returns a 404 status with the page title “Site not found”, confirming that the site is currently offline. The domain appears on the PhishDestroy blocklist and is listed on one additional security blocklist.

VirusTotal scans report five detections out of ninety‑five vendors, reinforcing the malicious classification. Registration information lists Netlify as the registrar, and the domain’s nameserver records were not found in the available data. The observable indicators collectively point to a generic phishing infrastructure that has been taken down.

The lack of a resolved nameserver record and the absence of page content limit further attribution; no specific phishing kit, targeted brand, or lure type can be confirmed from the present evidence. Defenders should continue to block the domain at network perimeter and DNS filtering solutions, monitor the hosting IP for any resurgence, and consider adding the domain to internal threat‑intel feeds. Because the TLS certificate is valid and the site previously employed HSTS, future malicious payloads could be hosted on the same Netlify account, so periodic re‑evaluation of the host’s other subdomains is advisable.