upgolld-lugnex[.]godaddysites[.]com

This domain is flagged for hosting a generic phishing campaign targeting users of the Uphold digital asset platform. Analysis indicates the site impersonates the Uphold login interface, as evidenced by the page title 'Ûphold Loℊin | Sign In,' which employs Unicode character substitution to evade basic detection mechanisms. The threat type is classified as elevated due to its direct targeting of financial credentials, a common precursor to unauthorized account access and asset theft. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC, with an SSL certificate issued by Go Daddy Secure Certificate Authority - G2. The domain resolves to IP address 76.223.105.230, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. Despite a creation date of February 21, 2026—likely an attempt to appear legitimate through a future-dated registration—the domain has been detected by 20 out of 95 security vendors on VirusTotal and appears on one security blocklist. The use of a GoDaddy subdomain (godaddysites.com) suggests an effort to exploit the registrar's reputation to bypass initial scrutiny. Mitigation measures for this threat include immediate blocking of the domain and its resolving IP (76.223.105.230) at network perimeters. Organizations should deploy email filtering rules to quarantine messages containing Unicode obfuscation patterns (e.g., 'Ûphold' or 'Loℊin') and implement multi-factor authentication (MFA) for all financial and cryptocurrency-related accounts. End users should verify domain authenticity by cross-referencing URLs with official Uphold communications and report suspicious login attempts to the platform's security team. Given the domain's current offline status, continuous monitoring for reactivation or similar variants is recommended.