uipxholdloginx[.]gitbook[.]io

The domain uipxholdloginx.gitbook.io has been identified as a credential phishing resource specifically targeting users of the Uphold digital asset platform. Analysis confirms the site impersonates the legitimate Uphold login interface, presenting a fraudulent authentication portal designed to harvest user credentials. The domain is currently offline, though prior activity indicates a high-risk threat profile. Technical indicators reveal the domain was flagged by 13 of 95 security vendors on VirusTotal, with additional detections on three independent security blocklists. Infrastructure analysis shows the domain was registered through GitBook, resolving to the IP address 172.64.147.209, hosted on infrastructure associated with Cloudflare, Inc. in Canada. The SSL certificate is issued by Google Trust Services under the identifier WE1. Notably, the domain registration date is listed as May 06, 2026, suggesting potential manipulation of WHOIS records or an attempt to obscure true creation timelines. The page title, Ûphold Loℊin | Sign In 💎, contains non-standard Unicode characters likely intended to bypass basic detection mechanisms while maintaining visual similarity to the legitimate service. Current status confirms the domain has been taken offline, though the underlying infrastructure remains a potential vector for future malicious activity. Organizations and users are advised to implement proactive blocking of the domain and associated IP address within network security controls. Security teams should monitor for similar impersonation attempts using Unicode character substitution or GitBook-hosted resources. End users should verify the authenticity of login portals through official channels and enable multi-factor authentication to mitigate credential theft risks. Given the high-risk classification and prior detection history, this domain warrants continued monitoring for reactivation or migration to alternative hosting.