webs-uphld--sso-cdnx[.]typedream[.]app

P1: The domain webs-uphld--sso-cdnx.typedream.app is assessed as an active high-risk fake login infrastructure designed for credential theft through impersonated SSO-style authentication pages. The observed page is explicitly identified as a suspected phishing site, indicating ongoing abuse for user credential harvesting.

P2: Intelligence shows VirusTotal detection at 18/95 security vendors flagging the domain. The asset is registered via Squarespace Domains II LLC and was created on February 21, 2026. It resolves to IP 188.114.97.3 under AS13335 Cloudflare, Inc. The domain appears on 2 security blocklists and is actively blocked by PhishDestroy and PhishingDB. Google Safe Browsing also flags the domain as phishing. SSL certificate is issued by Google Trust Services with identifier WE1.

P3: Users interacting with this domain should assume credential compromise risk. If credentials were entered, immediate password reset is required for all potentially reused accounts, along with session invalidation across connected services. Organizations should enforce domain-level blocking, monitor authentication logs for anomalous login attempts, and implement phishing-resistant multi-factor authentication. Network defenders should retain the indicators (188.114.97.3, domain string, and associated SSO impersonation pattern) for threat-hunting and detection rule updates. Continued monitoring is recommended due to active status and multi-source classification consensus.