# PhishDestroy domain threat record: mysso---uphold-login.typedream.app Content language: English Canonical HTML report: https://phishdestroy.io/domain/mysso---uphold-login.typedream.app/ Machine-readable companion: https://phishdestroy.io/domain/mysso---uphold-login.typedream.app/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-24 01:54:12 UTC - Last availability or vendor check: 2026-10-22 10:05:44 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 17/91 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: flagged ## Stored classification - Targeted brand: uphold ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: Typedream - Registrar country in stored WHOIS data: US - Last stored HTTP status: 301 - Registration date (registry RDAP, typedream.app): 2021-01-22 08:47:25 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a03177-d435-702d-862e-a6b8c0bdf04c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/mysso---uphold-login.typedream.app - Certificate Transparency search: https://crt.sh/?q=%25.mysso---uphold-login.typedream.app - Web Archive lookup: https://web.archive.org/web/*/https://mysso---uphold-login.typedream.app/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview mysso---uphold-login.typedream.app is a credential phishing page that imitates the sign-in screen of Uphold, the crypto and multi-asset trading platform. It targets Uphold customers who are steered to a fake login and type their account details into it. PhishDestroy first saw it on 2026-08-24. As of 2026-10-19 the site was still online and its content was reachable through a redirect. How the scam works The page presents itself as "Log In | Uphold®: | Sign In to Your Account". The "mysso" prefix in the address mimics a single sign-on portal. Victims usually reach it from a phishing email, text message or search ad that warns about the account or asks them to verify it. Whatever is typed into the form goes to the operators: email, password and often the one-time 2FA code. With those, they can log in to the real Uphold account before the code expires, change security settings and withdraw the crypto and cash balances. Evidence On 2026-09-02, 17 of 91 VirusTotal engines flagged the page. They include alphaMountain.ai, BitDefender, CyRadar, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet and G-Data, so the verdict comes from several independent security vendors. Google Safe Browsing lists it as SOCIAL_ENGINEERING, which triggers warnings in Chrome and other browsers. urlscan.io returned a malicious verdict and detected Uphold branding on the page. The domain is also on the PhishDestroy, MetaMask and SEAL blocklists. Infrastructure The page is not on a domain the operators registered. It sits on a subdomain of Typedream, a no-code website builder, which lets them publish a branded-looking page quickly and cheaply. Traffic is served through Cloudflare, Inc. from IP address 188.114.96.3, geolocated to Canada. The Google Trust Services certificate gives the page the padlock icon, but that only means the connection is encrypted. It says nothing about who runs the site. What to do If you entered your Uphold login here, open the Uphold app or type its address yourself, then change your password at once. Reset 2FA, sign out all other sessions and check recent withdrawals and any new whitelisted addresses. Contact Uphold support right away if you see activity you do not recognise. Change the password on any other service where you reused it, and treat follow-up "support" calls or emails with suspicion. Defenders should block the subdomain, search mail and proxy logs for visits or lures pointing to it, and report it to Typedream for removal. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a03177-d435-702d-862e-a6b8c0bdf04c/ VirusTotal report: https://www.virustotal.com/gui/domain/mysso---uphold-login.typedream.app Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mysso---uphold-login.typedream.app Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:57:12 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a03177-d435-702d-862e-a6b8c0bdf04c.png Captured: 2026-08-24 01:54:12 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a03177-d435-702d-862e-a6b8c0bdf04c.png Captured: 2026-08-24 01:54:12 UTC Source report: https://urlscan.io/result/01a03177-d435-702d-862e-a6b8c0bdf04c/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T05:51:04Z", "uuid": "01a03177-d435-702d-862e-a6b8c0bdf04c", "scanned_at": "2026-08-24T01:52:18Z", "final_url": "https://mysso---uphold-login.typedream.app/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://mysso---uphold-login.typedream.app/", "from": "http://mysso---uphold-login.typedream.app/", "status": 307 } ], "ip": "188.114.96.3", "domains": [ "fonts.googleapis.com", "image.typedream.com", "cdnjs.cloudflare.com" ], "ips": [ "104.17.24.14", "142.251.14.95", "104.18.14.90", "188.114.96.3" ], "asns": [ "13335", "15169" ], "countries": [ "US" ], "link_domains": [ "leguin.cyou", "typedream.com" ], "doc_hash": "21b164e1624db73e51b7e2ae237b65f9e25f93b8f17071fa006f2cbbd63f75f9", "script_hashes": [ "98971530458778abeb5749a04d3d3b833ae0df8e4b7375960b00b9e23af6a836", "caa66494a056f92f01d9d8ba80ec55360a6d10256fa7983c70d902ee8f29cc86", "6b551f0184e44f7d5a04c2c52f20e0bf1f8509a45b791c03a82118958b8e8bd1", "66d3385b97fac4ebc7c80d23782e81526ec33c0271a7d639148edf9f8885d4b3", "a7280da336d8bc5ee22b6067ebaa02bf025072e9d07758baf2f4602c795dc5f4", "562846f03fffa8619f79c3b2656fda2dc98019c62fd0dfc9ab3125af1a0124ab", "cecdbcd15f470ac05366f8b4d03e8b6a0da3d9d655c96080eaa3393611e4a046", "c7b5dd94081b60844217464260c70ad0ced2313ed69e05493a94dfe3fa70c13a", "ce7fe28337b6ead6b17634c8a4f2fa399cd307d5e847c9da0d0417af6c138adb", "7ab8fba833efce4a850c58ab12d4674cc1c3b41304a6f5840ba78afd7b6dd323" ], "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart", "webpackChunk_N_E", "__next_set_public_path__", "next", "__NEXT_DATA__", "__SSG_MANIFEST_CB", "__NEXT_P", "_N_E", "__NEXT_PRELOADREADY", "__MIDDLEWARE_MATCHERS", "__BUILD_MANIFEST", "__SSG_MANIFEST", "quicklink" ], "tls": { "san": [ "typedream.app", "*.typedream.app" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "typedream.app", "protocol": "QUIC", "valid_to": "2026-10-24T11:06:11Z", "valid_from": "2026-07-26T10:07:26Z" }, "domain_age_days": 0, "apex_age_days": 2017, "tls_age_days": 28, "tls_valid_days": 90, "requests": 70, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 87, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "uphold" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Uphold" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-powered-by": "Next.js" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T06:01:29Z", "uuid": "565bedb3-b12e-445e-8c70-39f9852eb4e9", "scanned_at": "2026-08-24T01:55:48Z", "final_url": "https://mysso---uphold-login.typedream.app/", "status": 200, "history": [ { "url": "https://mysso---uphold-login.typedream.app/", "status": 200 } ], "dom_hash": "deb405b970c495abdd6264c1fc2bd7aecf68c42e840c65de607fc3d56c7d3163", "doc_hash": "03ed2bddcae6ff43d1c4b33aef5ad563aa67a4a4d6536580494c2e8806bf0d19", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "mysso---uphold-login.typedream.app", "type": "A", "value": "104.21.37.85" }, { "name": "mysso---uphold-login.typedream.app", "type": "A", "value": "172.67.206.36" } ], "dnssec_valid": false, "ip": "104.21.37.85", "whois": { "registrar": "Squarespace Domains II LLC.", "created": "2021-01-22T08:47:25Z", "updated": "2026-01-12T09:38:06Z", "expires": "2027-01-22T08:47:25Z", "nameservers": [ "annalise.ns.cloudflare.com", "darwin.ns.cloudflare.com" ] } } } ```