uphoold-login[.]pages[.]dev

This domain, uphoold-login.pages.dev, is identified as a credential phishing infrastructure specifically targeting users of the Uphold digital asset platform. The page title, 'UpholdPortal.com – Secure Access to Your Digital Assets,' directly impersonates Uphold’s branding to deceive victims into submitting login credentials. No explicit drainer kit signatures were observed in initial scans, though the domain’s structure and hosting pattern align with known phishing campaigns leveraging content delivery networks for rapid deployment and evasion. The use of a subdomain under pages.dev further suggests an attempt to exploit perceived legitimacy while maintaining low operational overhead. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on September 02, 2020, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, with detections spanning phishing, fraud, and impersonation categories. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false credibility. Additionally, the domain appears on three security blocklists, including those focused on phishing and financial fraud. Google Safe Browsing currently marks the domain as offline, though historical records confirm prior active phishing campaigns. The domain is presently offline, likely due to takedown actions or voluntary suspension by the hosting provider. However, residual risk remains elevated due to the domain’s age, prior activity, and inclusion on multiple blocklists. Users who may have interacted with the domain should immediately revoke any submitted credentials, enable multi-factor authentication on legitimate accounts, and monitor for unauthorized transactions. Organizations are advised to update web filtering rules to block the domain and its associated IP, while security teams should correlate logs for any prior connections to 188.114.97.3 or related subdomains. Continuous monitoring is recommended, as threat actors frequently repurpose infrastructure for new campaigns.