secure-upkold-com[.]square[.]site

This domain, secure-upkold-com.square.site, is identified as a brand impersonation threat targeting Uphold, a cryptocurrency exchange platform. The site mimics the legitimate Uphold login portal, presenting itself as a secure account access page to deceive users into submitting credentials or sensitive financial information. No direct evidence of a drainer kit was observed, but the domain structure and content align with credential harvesting campaigns commonly used in financial fraud operations. Infrastructure analysis reveals the domain resolves to IP address 74.115.51.4, hosted on AS27647 (Weebly, Inc.) in the United States. The domain was registered through MarkMonitor, Inc. with a creation date of February 21, 2026, which is anomalous given the current date, suggesting potential domain spoofing or incorrect registration data. VirusTotal detection rates show 18 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt, a common practice among threat actors to mimic legitimacy. As of the latest verification, the domain has been taken offline, reducing immediate exposure to users. However, residual risk remains due to potential re-activation or migration of the phishing infrastructure to alternative domains. Organizations and users are advised to monitor for similar impersonation attempts, particularly those leveraging subdomains of legitimate platforms. Network-level blocking of the observed IP (74.115.51.4) and domain is recommended as a preventive measure. Users who may have interacted with the domain should reset credentials and enable multi-factor authentication on all financial accounts.