sso-app-uphuld[.]free[.]site[.]pro

Analysis of the domain sso-app-uphuld.free.site.pro, registered through REALTIME REGISTER B.V., reveals a credential-phishing operation impersonating Uphold. The domain resolves to 104.199.204.141, hosted on Google LLC infrastructure (AS396982, Taiwan). Nameservers ns1.site.pro through ns4.site.pro are used, and the domain was created on March 02, 2005, though this date may reflect the registration of the parent domain rather than the subdomain itself. The page title, 'Log In | Uphold®: | Secure Access to Your Digital Assets,' explicitly targets Uphold users, aligning with the credential-phishing classification. As of July 25, 2026, the domain returns an HTTP 404 status, indicating it is offline, though this does not preclude future reactivation.

SSL certificate analysis shows a Let's Encrypt issuer (E7), a common choice for both legitimate and malicious domains. Technologies detected include Apache HTTP Server and HTTP/3, though these are not inherently malicious. The domain appears on one security blocklist, and seven of 93 security vendors on VirusTotal flagged it as malicious. No further details on the phishing kit or exact redirection mechanisms are available from the provided data.

Defenders should treat this domain as a confirmed phishing threat targeting Uphold credentials. Blocking the domain at DNS and firewall levels is recommended, along with monitoring for connections to the associated IP 104.199.204.141. Given the offline status, continued vigilance for re-emergence under the same or similar subdomains is advised. No evidence of additional payload delivery or lateral movement vectors is present in the current data.