portal-login-up-hold[.]tem3[.]io

Portal-login-up-hold.tem3.io mimics the legitimate Uphold login page to deceive users into entering their credentials. Despite the domain being offline, it has already been flagged by 7 out of 92 vendors on VirusTotal as malicious. Additionally, it appears on public blocklists including PhishDestroy, MetaMask, and SEAL, and is flagged by Google Safe Browsing.

The domain's infrastructure is hosted by CloudFlare, Inc., with an IP address located in Canada. The SSL certificate is issued by Google Trust Services, which adds a layer of perceived legitimacy to the unsuspecting user. The page title, "Log In | Uphold® | Sign In to Your Account®", is designed to closely resemble that of the official Uphold website, further enhancing its deceptive nature.

Phishing domains like portal-login-up-hold.tem3.io exploit the gap between domain registration and antivirus database updates to capture user credentials. This particular domain was detected in the early stages, limiting its potential impact. The swift takedown of the site underscores the importance of proactive threat detection and rapid response to mitigate potential damage.