sso-upholes-log[.]framer[.]media

This domain, sso-upholes-log.framer.media, is a sophisticated phishing site specifically designed to steal login credentials from Uphold users. By mimicking the legitimate Uphold login page, it tricks victims into entering their email and password, which are then harvested by attackers. The site poses as a secure access portal but is entirely fraudulent, with no connection to the real Uphold platform. Users who fall for this scheme risk having their cryptocurrency accounts compromised and drained.

PhishDestroy's analysis reveals alarming indicators: VirusTotal flags this domain with 8 out of 95 security vendors detecting malicious activity, and Google Safe Browsing specifically categorizes it as phishing. The domain was registered on March 10, 2026, through CSC Corporate Domains, Inc., and its SSL certificate was issued by Let's Encrypt (E7), lending a false sense of security. The site resolves to IP address 31.43.160.6 and appears on 3 security blocklists. Despite currently being offline, the domain's registration and hosting details suggest a well-orchestrated attack aimed at Uphold customers.

If a user has already visited this domain and entered any credentials, they should immediately change their Uphold password and enable two-factor authentication. It is also critical to monitor the account for unauthorized transactions and contact Uphold support to report the incident. For general safety, always verify the URL before logging in and avoid clicking links from unsolicited messages. PhishDestroy recommends using a password manager to autofill credentials only on legitimate sites and keeping security software updated to block known phishing domains.