# PhishDestroy domain threat record: upwardform.top

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/upwardform.top/
Machine-readable companion: https://phishdestroy.io/domain/upwardform.top/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 16:19:53 UTC
- Last availability or vendor check: 2026-10-26 16:39:27 UTC
- Stored record updated: 2026-10-26 19:35:37 UTC
- VirusTotal detections in the stored snapshot: 5/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Gname.com Pte. Ltd.
- Registrar country in stored WHOIS data: KH
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-27 10:43:47 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17913-92eb-76bb-aba1-25daad400e79/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/upwardform.top
- Certificate Transparency search: https://crt.sh/?q=%25.upwardform.top
- Web Archive lookup: https://web.archive.org/web/*/https://upwardform.top/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot dated 2026-10-26 shows a blank white page with no visible text, form fields, buttons, offers or brand, so no impersonated service could be observed. PhishDestroy listed upwardform.top after automated intake recorded a VirusTotal domain detection together with the domain's 29-day age. It was first seen by PhishDestroy on 2026-10-26.

How the scam works
Pages of this category typically act as staging or redirect steps in a phishing funnel, moving a visitor arriving from a message toward a later credential or payment request. Because the capture shows no readable content, the specific lure and any impersonated brand are not observable here, and anything submitted through such a page would go to an unverified operator. Treat links to this domain as a category risk for credential and payment phishing.

Evidence
The captured screenshot on 2026-10-26 shows only a blank white page with no readable text, fields or branding. urlscan's engine verdict scored the page malicious at 89 on 2026-10-26 while its overall verdict remained not malicious, and an earlier capture on 2026-10-24 was verdicted clean. VirusTotal analysis dated 2026-10-23 flagged the domain as malicious, with LevelBlue labelling it phishing and alphaMountain.ai, SOCRadar, Ermes and Forcepoint ThreatSeeker adding suspicious, not-recommended or spam labels. Cloudflare Radar tagged it phishing with newly seen domain risks on 2026-10-26 and OTX recorded 5 pulses, while Google Safe Browsing, 0 of 12 DNS resolvers, 0 external blocklists and urlscan's overall verdict showed no flag. urlscan also recorded a 307 redirect from the HTTP entry to the HTTPS entry, a Vue front end built with vue-i18n and Vite exposing TradingView and PubSub globals, 16 trackers among 24 requests, and 4 distinct script hashes (cb0c6c9f1771...) for campaign pivoting.

Infrastructure
The 2026-10-26 header check found no Content-Security-Policy, no HSTS, and no X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP or CORP headers, while DNSSEC was unsigned with no DS, RRSIG or DNSKEY records. Email authentication was thin: SPF recorded zero lookups and no DKIM or DMARC data was captured, though a CAA record was present. The domain was registered on 2026-09-27 through Gname.com Pte. Ltd. and used Cloudflare-managed DNS behind a Cloudflare WAF. TLS used version 1.3 with cipher TLS_AES_256_GCM_SHA384, forward secrecy and ALPN h2 under a Let's Encrypt certificate.

What to do
If you submitted credentials or personal data on this domain, change that password on the genuine service and enable 2FA, and treat follow-up messages as untrusted. Do not reuse the same password anywhere else. Defenders should block upwardform.top at proxy, mail and DNS layers, pivot on the four recorded script hashes, and keep it blocked until vendor verdicts clear.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17913-92eb-76bb-aba1-25daad400e79/
Cloudflare Radar report: https://radar.cloudflare.com/scan/915fe799-15c4-43d3-9b27-8f75cde7f13d
URLQuery report: https://urlquery.net/report/190e3efb-1976-4fc7-98a3-483727704365
Stored capture screenshot: https://i.ibb.co/Xf9XN2YM/8bfee1112de1.png
Cloudflare Radar screenshot (2026-10-26T16:30:17Z): https://screenshots.phishdestroy.io/cf/915fe799-15c4-43d3-9b27-8f75cde7f13d.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/190e3efb-1976-4fc7-98a3-483727704365.png
URLScan screenshot (2026-10-23T19:11:26Z): https://screenshots.phishdestroy.io/us/01a16a2c-a9b1-7687-b799-f16d9bbd6cdd.png
URLScan capture report: https://urlscan.io/result/01a16a2c-a9b1-7687-b799-f16d9bbd6cdd/
URLScan screenshot (2026-10-23T19:27:19Z): https://screenshots.phishdestroy.io/us/01a16a3b-34b9-778a-be28-31b72b38bad9.png
URLScan capture report: https://urlscan.io/result/01a16a3b-34b9-778a-be28-31b72b38bad9/
URLScan screenshot (2026-10-24T09:55:38Z): https://screenshots.phishdestroy.io/us/01a16d56-41cc-7611-b04b-faf88c35f5f2.png
URLScan capture report: https://urlscan.io/result/01a16d56-41cc-7611-b04b-faf88c35f5f2/
VirusTotal report: https://www.virustotal.com/gui/domain/upwardform.top
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=upwardform.top
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 18:09:29 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Xf9XN2YM/8bfee1112de1.png
  Captured: 2026-10-26 16:39:27 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17913-92eb-76bb-aba1-25daad400e79.png
  Captured: 2026-10-26 16:39:27 UTC
  Source report: https://urlscan.io/result/01a17913-92eb-76bb-aba1-25daad400e79/
- URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16d56-41cc-7611-b04b-faf88c35f5f2.png
  Captured: 2026-10-24 09:55:38 UTC
  Source report: https://urlscan.io/result/01a16d56-41cc-7611-b04b-faf88c35f5f2/
  SHA-256: 31308e0f63e8ac82f4d42604bab295245accfafa98e2d4430196a98ec50258e3
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16a2c-a9b1-7687-b799-f16d9bbd6cdd.png
  Captured: 2026-10-23 19:11:26 UTC
  Source report: https://urlscan.io/result/01a16a2c-a9b1-7687-b799-f16d9bbd6cdd/
  SHA-256: 31308e0f63e8ac82f4d42604bab295245accfafa98e2d4430196a98ec50258e3
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16a3b-34b9-778a-be28-31b72b38bad9.png
  Captured: 2026-10-23 19:27:19 UTC
  Source report: https://urlscan.io/result/01a16a3b-34b9-778a-be28-31b72b38bad9/
  SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/915fe799-15c4-43d3-9b27-8f75cde7f13d.png
  Captured: 2026-10-26 16:30:17 UTC
  Source report: https://radar.cloudflare.com/scan/915fe799-15c4-43d3-9b27-8f75cde7f13d
  SHA-256: e474a175f992442a69e502e42d7748076f7b37bd4715cf7c03ed2b7ff55231c3
- URLQuery: https://screenshots.phishdestroy.io/uq/190e3efb-1976-4fc7-98a3-483727704365.png
  Source report: https://urlquery.net/report/190e3efb-1976-4fc7-98a3-483727704365
  SHA-256: 039b0a7946836176c2d08c0d3c8f2fe6d59c6401a238a41089a11bcf11193c6c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T17:31:39Z",
        "uuid": "01a17913-92eb-76bb-aba1-25daad400e79",
        "scanned_at": "2026-10-26T16:38:14Z",
        "final_url": "https://upwardform.top/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://upwardform.top/",
                "from": "http://upwardform.top/",
                "status": 307
            }
        ],
        "ip": "188.114.97.3",
        "ips": [
            "188.114.97.3"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747",
        "script_hashes": [
            "cb0c6c9f1771d252eee7caa043bdd7cfffbd52c2cc4b18b7be7c4554ed069151",
            "517967fc937185017fc5e95bb3a7a64b79cfeb54a2a0d863838544484193d0a7",
            "fcedb95ecec99dc0c386f9f2e87b0eb47b73e52dbba39c2607fe27168b7f6bc3",
            "7d4f4be3f101d1e21ba4cd1a6461fb8749abe0451bef742c484f8e3b1b71815a"
        ],
        "globals": [
            "TradingView",
            "addLink",
            "addMeta",
            "lib",
            "rem",
            "dpr",
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_SSR_SETTERS__",
            "__INTLIFY_PROD_DEVTOOLS__",
            "__INTLIFY_JIT_COMPILATION__",
            "__INTLIFY_DROP_MESSAGE_COMPILER__",
            "__VUE_I18N_FULL_INSTALL__",
            "__VUE_I18N_LEGACY_API__",
            "setImmediate",
            "clearImmediate",
            "PubSub",
            "__config",
            "__theme",
            "__VUE__",
            "__vite_is_modern_browser"
        ],
        "storage_keys": [
            "us_THEME",
            "main",
            "us_LANGUAGE"
        ],
        "domain_age_days": 29,
        "apex_age_days": 29,
        "tls_age_days": 29,
        "tls_valid_days": 89,
        "requests": 24,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 89,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "image/png"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T16:33:14Z",
        "uuid": "915fe799-15c4-43d3-9b27-8f75cde7f13d",
        "scanned_at": "2026-10-26T16:30:17Z",
        "final_url": "https://upwardform.top/",
        "status": 200,
        "history": [
            {
                "url": "https://upwardform.top/",
                "status": 200
            }
        ],
        "dom_hash": "02aa23913af900979125ffd9af6a217edc62c322b4e03a446d7adead180e0915",
        "doc_hash": "66e7593a907dc48b7618a57ee1dee1e890c853aebf8af615a3868044acd2bbfa",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "upwardform.top",
                "type": "A",
                "value": "104.21.78.115"
            },
            {
                "name": "upwardform.top",
                "type": "A",
                "value": "172.67.220.156"
            },
            {
                "name": "upwardform.top",
                "type": "AAAA",
                "value": "2606:4700:3036::6815:4e73"
            },
            {
                "name": "upwardform.top",
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:dc9c"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.78.115",
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "created": "2026-09-27T12:43:47Z",
            "updated": "2026-09-27T12:51:48Z",
            "expires": "2027-09-27T12:43:47Z",
            "nameservers": [
                "john.ns.cloudflare.com.",
                "linda.ns.cloudflare.com."
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T17:30:59Z",
        "analysis_at": "2026-10-23T19:14:05Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 1,
            "suspicious": 4,
            "undetected": 34
        },
        "detections": {
            "Ermes": "not recommended",
            "SOCRadar": "suspicious",
            "LevelBlue": "phishing",
            "alphaMountain.ai": "suspicious",
            "Forcepoint ThreatSeeker": "spam"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Suspicious (alphaMountain.ai)"
        },
        "registrar": "Gname.com Pte. Ltd.",
        "created": "2026-09-27T12:43:47Z",
        "expires": "2027-09-27T12:43:47Z",
        "updated": "2026-09-27T12:51:48Z",
        "first_seen": "2026-09-27T13:20:54Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.220.156"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:dc9c"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.78.115"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "linda.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "john.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "john.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::6815:4e73"
            }
        ],
        "dns_at": "2026-10-23T19:19:49Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.upwardform.top",
                "upwardform.top"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6443f2492041246a4691f6483f2380bdcfe",
            "sha256": "388cf59d8661ee7b20db4b938dc4174c9f15d8733d33a6448454c01765610341",
            "subject": "upwardform.top",
            "valid_to": "2026-12-26T12:00:26Z",
            "valid_from": "2026-09-27T12:00:27Z"
        },
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "registrar_iana_id": "1923",
            "registrar_url": "http://www.gname.com",
            "created": "2026-09-27T12:43:47Z",
            "updated": "2026-09-27T12:51:48Z",
            "expires": "2027-09-27T12:43:47Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "john.ns.cloudflare.com",
                "linda.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-27T12:43:47Z",
                "registration": "2026-09-27T12:43:47Z",
                "last update of RDAP database": "2026-10-18T12:51:52Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:36:23Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "upwardform.top"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T16:30:46Z",
            "first": "2026-09-27T15:40:35Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.03,
            "avg_page_bytes": 2345
        },
        "social_tags": {
            "title": "Csvpwecs",
            "robots": "all",
            "ogImage": "/platform/us/logo_144.png?2.0.1791569477703",
            "ogTitle": "Csvpwecs",
            "keywords": "Csvpwecs",
            "themeColor": "#ffffff",
            "description": "Csvpwecs",
            "ogDescription": "Csvpwecs"
        },
        "trackers": {
            "requests": 16
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 1,
                "tls": 60,
                "wait": 461,
                "connect": 6,
                "download": 0
            },
            "response_ms": 528
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 6378,
            "co2_grams": 0.0002,
            "cleaner_than": 81
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.193.185",
                    "host": "john.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.58.250",
                    "host": "linda.ns.cloudflare.com"
                }
            ],
            "zone": "upwardform.top"
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "upwardform.top"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "john.ns.cloudflare.com",
                "linda.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"john.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416060223, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3121::3",
                "2a06:98c1:3120::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3121::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://upwardform.top"
            ]
        },
        "whois": {
            "registrar": "Gname.com Pte. Ltd.",
            "created": "2026-09-27T12:43:47Z",
            "updated": "2026-09-27T12:51:48Z",
            "expires": "2027-09-27T12:43:47Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "john.ns.cloudflare.com",
                "linda.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```