uphold-log[.]pop[.]site

Analysis of the domain uphold-log.pop.site indicates a high-risk phishing operation targeting users of the Uphold financial platform. The domain was registered on February 13, 2025, through GoDaddy.com, LLC, and currently resolves to the IP address 66.33.60.35, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The page title, 'uphold-log,' mimics legitimate login portals, a common tactic in credential-harvesting attacks. Eight out of ninety-five security vendors on VirusTotal have flagged this domain, and it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, further corroborating its malicious classification. Infrastructure analysis reveals the use of Vercel nameservers (ns1.vercel-dns-3.com, ns2.vercel-dn) alongside GoDaddy-controlled servers (ns05.domaincontrol.com, ns06.domaincontrol.com). The site employs a Let's Encrypt SSL certificate (YR2) and technologies such as Node.js, React, Next.js, and Webpack, which are consistent with modern phishing kits designed to evade detection. The presence of HSTS and Google Analytics suggests an attempt to appear legitimate while tracking victim interactions. The domain's Gridinsoft trust score of 0/100 reinforces its classification as a confirmed threat. At present, the domain remains active, returning an HTTP 200 status, indicating that the phishing page is operational. The combination of a recently registered domain, financial-themed branding, and detection by multiple security vendors strongly suggests this is a credential-harvesting campaign. Defenders should treat this domain as hostile and prioritize blocking it at the DNS or network level. Organizations using Uphold or similar platforms should alert users to verify URLs before entering credentials, as the domain closely resembles legitimate login portals. Additional monitoring of related infrastructure, particularly Vercel-hosted domains with similar naming patterns, may uncover further malicious activity.