faq-uphold-web-sso[.]weebly[.]com

This domain, faq-uphold-web-sso.weebly.com, is currently flagged as a high‑risk generic phishing site. The domain resolves to the IPv4 address 74.115.51.9 and is hosted on infrastructure that uses four AWS Route 53 name servers (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns). The registration record shows a creation date of 29 March 2006 and indicates that the domain was registered through MarkMonitor Inc., a registrar commonly associated with legitimate brand protection services. Despite the long‑standing registration, Google Safe Browsing classifies the site under the “social engineering” category, which aligns with the generic phishing designation provided in the threat feed.

VirusTotal analysis reports that 15 of 91 scanned security vendors have raised detections against the domain, suggesting that a minority of engines have identified malicious behavior while the majority have not flagged it. Independent blocklist monitoring confirms that the domain appears on three known security blocklists, and it is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering solutions. These multiple independent detections reinforce the assessment that the domain is being used for malicious credential‑harvesting or related social‑engineering campaigns. At present, public intelligence does not include detailed information about the site’s HTTP response codes, SSL certificate properties, page title, or any observed payloads.

Consequently, the exact phishing vector—whether it mimics a login portal, a payment page, or another service—remains uncertain. Analysts should therefore treat any traffic to the domain as potentially hostile and enforce blocking at the network perimeter, endpoint, and browser levels. Continuous monitoring of the IP address 74.115.51.9 and the associated AWS name servers is recommended, as adversaries frequently shift hosting to evade takedown.