url--uphold-cdn[.]typedream[.]app

This domain, url--uphold-cdn.typedream.app, is flagged for brand impersonation targeting Uphold, a cryptocurrency and digital asset platform. Analysis indicates the site presents a fraudulent login interface, mimicking Uphold’s official authentication portal with the page title 'Log In | Uphold® | Sign In to Your Account | Uphold Login.' The domain does not appear to be associated with a known drainer kit but is designed to harvest credentials or sensitive financial information from victims under false pretenses.

Technical indicators confirm the domain’s malicious nature. VirusTotal reports 21 out of 95 security vendors flagging the domain as malicious. The domain was registered through Squarespace Domains II LLC and resolves to the IP address 188.114.97.3, hosted on Cloudflare’s infrastructure (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. The domain was created on February 21, 2026, an anomalous future date suggesting possible registry manipulation or typosquatting. It appears on three security blocklists, and multiple threat intelligence feeds have already classified it as active phishing infrastructure.

The domain remains active and poses a high risk to users. While it is blocked by several security feeds, including enterprise-level detection systems, the infrastructure remains accessible to unsuspecting users. Immediate mitigation includes blacklisting the domain and IP across network security controls, invalidating sessions initiated from this domain, and notifying affected users. The remaining risk is elevated due to the domain’s convincing mimicry of Uphold’s branding and the use of Cloudflare’s IP space, which may evade some basic detection mechanisms. Users should verify the legitimacy of any Uphold-related login page by checking the URL and SSL certificate details before entering credentials.