secure-uphold-cdn[.]weebly[.]com

Analysis of secure-uphold-cdn.weebly.com indicates active credential phishing infrastructure as of July 29, 2026. The domain, hosted on Weebly's platform, resolves to IP 74.115.51.9 and is flagged by multiple security vendors, including PhishDestroy, MetaMask, and SEAL. It appears on three security blocklists, and Google Safe Browsing classifies it under social engineering threats. The domain was originally registered on March 29, 2006, through MarkMonitor Inc., with nameservers under AWS (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns).

VirusTotal reports 18 of 91 security vendors detecting malicious activity associated with this domain, reinforcing its high-risk classification. Infrastructure analysis reveals the domain leverages Weebly's subdomain structure, a common tactic to evade initial scrutiny by blending with legitimate services. The use of AWS nameservers suggests scalable hosting, while the long-standing registration date (2006) does not mitigate its current malicious status. No specific brand impersonation or phishing kit details are confirmed in available data, though the credential phishing classification implies targeting of login credentials, likely through a spoofed authentication portal.

Defenders should treat this domain as actively malicious. Recommended actions include blocking resolution to 74.115.51.9 at the network level, updating endpoint protection rules to flag the domain, and monitoring for related subdomains or IPs. Security teams should also review logs for connections to this domain or its associated IP, particularly in contexts involving credential submission or financial services. Given the domain's presence on multiple blocklists and detection by major vendors, immediate containment measures are advised.