faq-uphold[.]dream[.]space

This domain, faq-uphold.dream.space, is confirmed as a brand impersonation threat targeting Uphold, a cryptocurrency and financial services platform. Analysis indicates the site was designed to mimic Uphold’s official login interface, as evidenced by the page title 'Log In | Uphold | Sign In to Your Account,' with the intent of harvesting user credentials. The domain is currently offline, but prior activity aligns with credential theft and potential secondary payload delivery, such as crypto drainers or malware. Infrastructure analysis reveals the domain was registered on February 23, 2026, through Go Daddy, LLC, and resolved to the IP address 104.18.20.20, hosted on Cloudflare’s network (AS13335). Security vendor assessments show 18 of 95 VirusTotal engines flagged the domain as malicious, while it appears on three independent security blocklists. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as it is consistent with legitimate-looking but fraudulent domains. Additional detection by PhishDestroy, MetaMask, and SEAL further corroborates the malicious classification. The domain’s current offline status reduces immediate risk, but historical indicators suggest it may resurface under a different name or infrastructure. Users who interacted with this domain should immediately reset credentials for Uphold and any accounts sharing the same login details. Organizations are advised to block the domain and IP at the perimeter, monitor for related phishing campaigns, and educate users on identifying brand impersonation tactics, particularly those targeting financial or cryptocurrency platforms. Security teams should review logs for connections to 104.18.20.20 and correlate with other known Uphold-themed phishing domains for broader threat hunting.