iuphild-logine[.]gitbook[.]io

This domain, iuphild-logine.gitbook.io, is identified as a credential phishing site specifically targeting users of the Uphold digital asset platform. Analysis indicates the page employs brand impersonation, presenting a fraudulent login interface titled 'Ûphold - login' to harvest user credentials. No direct evidence of a crypto drainer kit was observed, but the credential theft mechanism aligns with common pre-attack vectors for account takeover and subsequent unauthorized transactions. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 30, 2014, though the malicious content appears to have been hosted recently. It resolves to the IP address 172.64.147.209, located in Canada under Cloudflare’s network. The domain is flagged by Google Safe Browsing for phishing and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal reports 19 out of 95 security vendors detecting the domain as malicious, reinforcing its high-risk classification. As of the latest verification, the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, residual risk remains for users who may have interacted with the page prior to its removal. Organizations and individuals are advised to monitor for unauthorized access attempts on Uphold accounts and rotate credentials if exposure is suspected. Network-level blocking of the domain and associated IP address is recommended to prevent potential re-emergence or related campaigns.