holdup-app-io[.]framer[.]ai

The domain holdup-app-io.framer.ai has been identified as a sophisticated credential theft operation specifically designed to impersonate the legitimate Uphold cryptocurrency platform. Currently marked as offline, this malicious site was engineered to capture login credentials from unsuspecting users seeking access to their Uphold accounts. The page title, "Uphold Login ✦ | Smart, Protected," demonstrates a deliberate attempt to mimic the official brand's appearance and language, making it particularly dangerous for users who may not scrutinize URLs carefully.

Technical analysis reveals that this domain resolves to IP address 31.43.160.6 and was registered through CSC Corporate Domains, Inc. VirusTotal data shows that 20 out of 95 security vendors flagged this domain as malicious, while Google Safe Browsing specifically identified it as a phishing threat. The site appeared on three separate security blocklists prior to being taken down, and its SSL certificate was issued by Let's Encrypt with an E8 designation, a common choice among fraudulent sites seeking quick and free encryption. These indicators collectively paint a clear picture of a well-orchestrated phishing campaign aimed at the cryptocurrency community.

Given that the domain has now been taken offline, the immediate risk of credential theft through this specific URL is mitigated. However, the PhishDestroy team strongly recommends that any user who may have interacted with this site change their Uphold account passwords immediately and enable two-factor authentication if not already active. Users should also monitor their accounts for any unauthorized transactions and report any suspicious activity to Uphold support. As a general precaution, always verify the authenticity of any login page by checking the URL directly in the browser's address bar and avoiding links from unsolicited emails or messages.