sso-upholdlogin--cdn[.]webflow[.]io

The domain sso-upholdlogin--cdn.webflow.io was registered through MarkMonitor, Inc. and created on 08 May 2013. Its authoritative name servers, journey.ns.cloudflare.com and lamar.ns.cloudflare.com, resolve the domain to the IP address 104.18.36.248, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The site served a TLS certificate issued by Google Trust Services under the WE1 label, indicating a valid HTTPS endpoint, and the underlying web server advertised Cloudflare and HTTP/3 support. The page title observed at the URL was “Log In | Uphold® - Sign In to Your Account”, directly referencing the Uphold brand.

The intelligence indicates the site was used for credential phishing, impersonating Uphold to harvest user login data. VirusTotal analysis recorded 13 detections out of 95 scanned scanners, and the domain appears on a single security blocklist. PhishDestroy has also blocked the domain. At the time of analysis the site returned an HTTP 404 response and is listed as offline.

The available evidence confirms that the domain was leveraged as a brand‑impersonation phishing vector targeting Uphold users. However, no additional payloads, redirect chains, or malicious scripts have been captured, leaving the full scope of the campaign uncertain. Defenders should continue to monitor the IP address and the associated Cloudflare edge nodes for any re‑use of the same infrastructure, update web filtering rules to block the domain and its sub‑domains, and ensure that user‑facing authentication portals for Uphold are protected with multi‑factor authentication and user‑education on checking URL authenticity. The presence on a blocklist and multiple vendor detections suggests that the domain should be treated as malicious until further investigation confirms remediation.