over-uphlld-o-sso[.]daftpage[.]com

Analysis of over-uphlld-o-sso.daftpage.com shows a high‑risk credential‑phishing infrastructure targeting the Uphold brand. The domain was registered through OVH SAS on 24 October 2021 and continues to resolve to the IPv4 address 216.150.16.129, which belongs to AS16509 Amazon.com, Inc. in the United States. DNS resolution uses the Vercel‑provided authoritative servers ns1.vercel-dns.com and ns2.vercel-dns.com, indicating that the site is hosted on the Vercel platform. TLS is supplied by a Let’s Encrypt R13 certificate, and the HTTP response returns a permanent redirect (308) under HSTS enforcement, suggesting an attempt to preserve session security for malicious purposes. The page title reported by the scanner, “Uphold Login – Manage Crypto, Stocks & Money”, directly references the targeted brand, confirming the impersonation claim.

Technology fingerprints reveal a Node.js stack with React and Next.js, supplemented by embedded YouTube content, Google Analytics tracking, and Crisp Live Chat widgets, all typical of modern web applications but also frequently abused in phishing kits. The site is listed on at least one security blocklist and has been actively blocked by PhishDestroy. Reputation scoring from Gridinsoft rates the domain at 0 / 100, reflecting a lack of trust. VirusTotal analysis indicates that 15 of 93 scanning engines flag the domain as malicious, reinforcing the suspicion of credential harvesting.

No additional public threat‑intel feeds are cited, and the current blocklist coverage appears limited to a single source, leaving a potential detection gap. Defenders should block the domain at the network perimeter, enforce DNS sink‑holing for the associated IP range, and monitor for outbound connections to 216.150.16.129. Endpoint protection should be configured to alert on attempts to access URLs containing the exact page title or the “Uphold Login” phrase.