app-uphold-auth[.]pages[.]dev

This domain is flagged as a high-risk credential theft phishing site designed to harvest login credentials from users under the guise of a legitimate financial service. Analysis indicates the infrastructure impersonates Uphold, a cryptocurrency platform, to deceive victims into entering sensitive account information. The page title, 'Secure Access — Protect Your Account,' reinforces the false legitimacy of the operation, increasing the likelihood of successful compromise. Infrastructure analysis reveals the domain was registered on September 18, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, hosted by Cloudflare in California. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to evade initial suspicion. Security vendor detections on VirusTotal stand at 3 out of 95, indicating early-stage identification with limited coverage. The domain appears on one security blocklist, specifically PhishDestroy, confirming its malicious classification. No historical reputation or legitimate use cases were found, further supporting its fraudulent intent. Mitigation requires immediate blocking of the domain and IP at network and endpoint levels. Users who may have interacted with the site should reset credentials for any financial or cryptocurrency accounts, particularly those associated with Uphold. Multi-factor authentication should be enforced on all critical accounts to prevent unauthorized access. Organizations should monitor for indicators of compromise, including the domain, IP, and SSL certificate fingerprint, and update detection rules to include these artifacts. Awareness training should emphasize verification of domain authenticity before entering credentials, especially for financial services.