myupholdio[.]dream[.]space

Analysis of the domain myupholdio.dream.space, registered on February 21, 2026, indicates a high-risk credential-phishing operation targeting Uphold users. The site presents a page titled 'Log In Uphold® | Sign In to Your Account™,' directly impersonating the Uphold brand. Infrastructure analysis reveals the domain resolves to IP 104.18.20.20, hosted on Cloudflare's network (AS13335) in the United States, and employs nameservers oaklyn.ns.cloudflare.com and titan.ns.cloudflare.com. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as the domain returns an HTTP 302 redirect status, a common tactic to obscure malicious intent or redirect victims to further phishing infrastructure.

Detection data shows the domain is flagged by 13 of 93 security vendors on VirusTotal, with active blocks enforced by PhishDestroy, MetaMask, and SEAL. It appears on three independent security blocklists, and Gridinsoft assigns a trust score of 0/100. The presence of a 'Seed Phrase Phishing' kit suggests the campaign is designed to harvest cryptocurrency wallet credentials, aligning with the credential-phishing classification. Technologies detected on the domain include Three.js, ECharts, Tailwind CSS, jsDelivr, HSTS, cdnjs, and Cloudflare, which are not inherently malicious but are frequently leveraged to enhance phishing site functionality and evade detection.

The domain remains active as of July 23, 2026, with no evidence of takedown or remediation. Defenders should treat this domain as a confirmed phishing resource and implement blocking at the network and endpoint levels. Given the Cloudflare hosting and use of legitimate CDNs, IP-based blocking alone may be insufficient; domain-based blocking and monitoring for related infrastructure (e.g., subdomains, newly registered lookalike domains) are recommended.