uplholdlogin[.]gitbook[.]io

This domain is flagged under credential phishing classification with the page title Ûphold | Login. Infrastructure analysis reveals it resolves to IP 172.64.147.209 under AS13335 Cloudflare, Inc. in the US. The domain was registered on March 30, 2014 through Cloudflare, Inc. and uses nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. It operates with Cloudflare technologies, supports HTTP/3, returns HTTP status 307, and presents an SSL certificate issued by Google Trust Services / WE1. Current status remains active as of July 12, 2026.

Detection metrics include a Gridinsoft trust score of 0/100, VirusTotal detection by 14 out of 95 security vendors, and listings on exactly two security blocklists. The domain is blocked by PhishDestroy and PhishingDB. These indicators establish the presence of known malicious associations without requiring further external confirmation.

Exact page content beyond the recorded title remains unanalyzed. The domain age since 2014 places registration well before the report date, providing no temporal anomaly. No additional brand references or kit fingerprints appear in the available data beyond the credential phishing label and Uphold login title string.

Defenders should add uplholdlogin.gitbook.io to blocklists, monitor for related subdomains on gitbook.io, and review any traffic logs referencing the IP 172.64.147.209 or the listed nameservers. Organizations handling credential flows should enforce multi-factor authentication and alert users to verify domains directly through official channels rather than following external links.