sso----uphold--com----cdnn-auth[.]webflow[.]io

PhishDestroy identifies the domain sso----uphold--com----cdnn-auth.webflow.io as an active cryptocurrency phishing threat. This domain mimics the legitimate Uphold SSO authentication portal to deceive users into surrendering credentials for cryptocurrency wallets or exchanges. The threat is currently active and leverages impersonation of a major financial brand to enhance credibility. This domain was flagged by 14 of 95 VirusTotal security vendors and appears on two independent blocklists maintained by SEAL and MetaMask. It resolves to IP address 104.18.36.248 and operates under a Google Trust Services SSL certificate, which may be leveraged to bypass initial suspicion. The domain is hosted on the Webflow platform, a legitimate website builder, which increases the risk of user trust due to its professional appearance. Creation date and registrar details are obscured or unavailable due to obfuscation techniques commonly used in phishing campaigns. The elevated risk level of this domain is supported by its dual blocklist presence and partial detection by security vendors. Users attempting to access this domain may be redirected to malicious login forms designed to harvest cryptocurrency wallet credentials or two-factor authentication codes. PhishDestroy recommends avoiding this domain entirely and reporting any prior interactions to relevant cybersecurity teams. If this domain was accessed in error, users should revoke any entered credentials immediately and scan devices for malware. Organizations should update firewall rules and DNS blocklists to include this domain and associated IP address to prevent further exposure.