uphold-isso-login[.]webflow[.]io

PhishDestroy identifies uphold-isso-login.webflow.io as a credential phishing site currently active and impersonating the Uphold cryptocurrency platform. The domain uses a Webflow-hosted subdomain to mimic Uphold's login interface, luring users into entering their credentials under false pretenses. This deceptive tactic aims to harvest authentication details for unauthorized access to Uphold accounts and potential crypto fund theft.

This domain was flagged by 1 of 95 VirusTotal security vendors and is protected by a Google Trust Services SSL certificate. It resolves to the IP address 104.18.36.248 and is hosted on Webflow’s infrastructure. While the exact registration date is not publicly disclosed, the combination of low detection rates, high-risk SSL trust, and impersonation of a regulated financial platform elevates the risk profile significantly. The domain’s recent registration, minimal threat intelligence, and lack of brand association suggest a short-lived attack designed for immediate credential theft rather than long-term persistence.

Given the elevated risk and active status, users are strongly advised not to interact with uphold-isso-login.webflow.io or enter any credentials. PhishDestroy recommends verifying suspicious links via its real-time scanning tool before clicking. Additionally, enable multi-factor authentication (MFA) on all cryptocurrency accounts and monitor for unauthorized transactions. If credentials were entered, change passwords immediately and report the incident to Uphold support. This domain should be treated as high-risk due to its active credential harvesting campaign and should be blocked via DNS or network filters.