en-uphold-login-auth[.]weebly[.]com

The domain en-uphold-login-auth.weebly.com is currently taken offline but remains listed on at least one security blocklist and continues to be flagged by multiple detection services. Registration data shows the domain was created on March 29, 2006 and is registered through Safenames Ltd., a registrar commonly used for legitimate sites. The hosting infrastructure resolves to IP address 74.115.51.9, which belongs to AS27647 Weebly, Inc. in the United States. DNS resolution uses four Amazon Route 53 name servers (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns). An HTTPS service is present, secured with a Let's Encrypt certificate (issuer E8).

The web server returned a 404 HTTP status, indicating that the page is not currently serving content, yet the page title stored in the scan data reads "Log In | Uphold® | Sign In to Your Account," directly referencing the Uphold brand. The threat classification is credential phishing, and the site impersonates Uphold. VirusTotal analysis shows that 14 of 95 scanned security vendors flagged the domain, and Google Safe Browsing labels it as a social‑engineering site. The domain is also blocked by PhishDestroy.

Although the site is offline, the combination of brand‑specific page title, phishing classification, multiple vendor detections, and presence on blocklists indicates a high‑risk credential‑phishing campaign targeting Uphold users. Defenders should continue to block the domain at network perimeter and proxy layers, monitor DNS queries for the associated name servers, and add the IP address 74.115.51.9 to reputation‑based deny lists. Incident response teams should advise users not to enter credentials on any site presenting the Uphold login page unless the URL is verified as the official domain. Ongoing threat‑intel feeds should be consulted for any re‑activation of the domain, and any related phishing kits should be examined for indicators of compromise.