logiuphold[.]ezycourse[.]com

This domain, logiuphold.ezycourse.com, is actively flagged as a cryptocurrency phishing site targeting users of the Uphold platform. Analysis indicates the page title explicitly references 'Uphold Login® - Access Your Crypto® Wallet,' suggesting an attempt to deceive victims into entering credentials for a legitimate crypto wallet service. The domain was registered on June 21, 2022, through NameCheap, Inc., and currently resolves to the IP address 172.67.73.21, hosted under AS13335 (Cloudflare, Inc.) in the United States. The infrastructure is protected by Cloudflare nameservers (jaime.ns.cloudflare.com and ullis.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which may complicate takedown efforts or attribution. Technical indicators reveal the domain is detected by 14 out of 95 security vendors on VirusTotal, with active listings on at least two security blocklists, including PhishDestroy and PhishingDB. The HTTP response code 302 suggests the site may employ redirects or cloaking techniques to evade detection or dynamically serve malicious content. Detected technologies include Ant Design, HSTS, Google Analytics, and Cloudflare Browser Insights, which are consistent with modern phishing kits designed to mimic legitimate login portals while tracking victim interactions. The exact content and functionality of the site remain unanalyzed, as no direct inspection has been conducted. However, the combination of a cryptocurrency-themed page title, Cloudflare hosting, and active blocklist presence strongly suggests an ongoing credential harvesting operation. Defenders should prioritize blocking the domain and associated IP (172.67.73.21) at the network level, while monitoring for related subdomains or newly registered lookalike domains under the ezycourse.com parent. Given the domain's age and continued activity, it may be part of a broader, persistent phishing campaign rather than a short-lived scam.