log--in-auth-uphold[.]webflow[.]io

This domain, log--in-auth-uphold.webflow.io, is flagged as a generic phishing resource targeting users of the Uphold digital asset platform. Analysis indicates the site replicates the legitimate Uphold login interface, presenting a fraudulent authentication portal designed to harvest user credentials and session tokens. The domain does not appear to deploy a known cryptocurrency drainer kit, but its credential-harvesting mechanism poses significant risk to account security and financial assets linked to Uphold services. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 13, 2026, through Webflow and resolves to IP address 172.64.151.8, hosted on Cloudflare infrastructure (AS13335). It is detected by 17 out of 95 security vendors on VirusTotal, with a presence on three independent security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing campaigns leveraging legitimate CDN services to evade detection. No association with Google Safe Browsing (GSB) alerts was recorded at the time of analysis, though proactive blocking by multiple security entities confirms its malicious classification. The domain has been taken offline, reducing immediate exposure risk. However, residual threats persist, including potential credential reuse by threat actors and secondary distribution via cached or mirrored instances. Users who interacted with the site are advised to invalidate active sessions, rotate passwords, and enable multi-factor authentication on all linked accounts. Organizations should monitor for unauthorized access attempts using harvested credentials and update internal blocklists to include the domain and associated IP address. Continuous vigilance is recommended, as similar phishing infrastructure may re-emerge under altered domains or hosting configurations.