Yggdrasil

The URL uses a subdomain of azurewebsites.net that contains the 'onedrive' brand name, a common tactic for phishing to appear legitimate while being hosted on free cloud services. +1 more

The URL uses a generic hosting domain (vercel.app) and explicitly includes the word 'copia' (copy), indicating it is an unauthorized clone of the Airbnb website. +1 more

The URL uses a free hosting service (Weebly) and contains suspicious keywords like 'freebucks' and 'illimite' (unlimited) which are classic indicators of gaming-related scams. +1 more

The URL uses a highly suspicious, mangled subdomain ('uup-hoolldlooggiinn') on a free GoDaddy hosting platform instead of the official 'uphold.com' domain. +1 more

The site is hosted on a free subdomain (weebly.com), which is a common tactic for phishing and highly uncharacteristic for an established ISP like Socket. +1 more

The page uses a generic 'I am not a robot' verification screen, a common tactic to bypass automated scanners and hide phishing content. +1 more

The site is hosted on a free website builder (Weebly) using a random numeric subdomain, which is a common tactic for low-cost phishing campaigns. +1 more

The website is hosted on a free subdomain (weebly.com), which is a common tactic for phishing and highly uncharacteristic for an official ISP login portal. +1 more

The page claims to be Yahoo in the footer but is hosted on a completely unrelated and suspicious domain (oceanicfish.cc), which is a clear indicator of brand impersonation. +1 more

The page claims to be Yahoo in the footer but is hosted on a completely unrelated and suspicious domain (oceanicfish.cc), which is a clear indicator of brand impersonation. +1 more

The page uses a classic phishing template ('Secure Document' lure) designed to trick users into clicking links that lead to credential harvesting sites. +1 more

The page uses a classic phishing template ('Secure Document' lure) designed to trick users into clicking links that lead to credential harvesting sites. +1 more