portal-uphold-access-eng[.]square[.]site

The domain portal-uphold-access-eng.square.site was flagged as a credential‑phishing site targeting the Uphold brand. Registration records show the domain was created on 5 February 2019 and is managed by MarkMonitor, Inc., a registrar commonly used by legitimate enterprises. Technical fingerprints indicate the site was hosted on Amazon Web Services and fronted by Cloudflare, with authoritative name servers ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, and ns-810.awsdns. The TLS certificate is issued by Let’s Encrypt (E7), a publicly trusted authority, and terminates on IP address 74.115.51.4, which belongs to AS27647 Weebly, Inc., located in the United States.

An HTTP request to the domain returns a 404 status, and the page title retrieved from the server reads “Log In | Uphold®: | Sign In to Your Account,” directly mimicking the branding of Uphold and confirming the impersonation intent. VirusTotal analysis recorded detections by ten of ninety‑five security vendors, and the domain appears on a single external blocklist. PhishDestroy has already taken the domain offline, and its current status is recorded as taken offline.

While the offline state prevents direct inspection of any malicious payload, the convergence of brand‑specific page titles, credential‑phishing classification, and multi‑vendor detections provide strong evidence of hostile intent. Defenders should add the domain and its associated IP address to DNS and web‑filter blocklists, monitor the hosting provider’s IP space for re‑use, and ensure that users are educated to verify official Uphold URLs before entering credentials. Continuous telemetry on the AWS/Cloudflare infrastructure associated with this domain is advised, as threat actors may re‑deploy similar impersonation pages using the same hosting profile.