logan-usa-upholleaid[.]godaddysites[.]com

The domain logan-usa-upholleaid.godaddysites.com was identified as a brand impersonation threat specifically targeting Uphold, a legitimate cryptocurrency wallet and exchange platform. This phishing domain was designed to deceive users into believing they were accessing the official Uphold login page, as evidenced by its page title "Uphṍld |Wallet Lṍgin," which employs homoglyph characters to evade detection. The threat type is brand impersonation, and no drainer kit was explicitly identified, though the site likely aimed to harvest login credentials and potentially seed phrases from unsuspecting victims.

Technical indicators for this domain are significant. VirusTotal reports 15 out of 95 security vendors flagging the domain as malicious, reflecting broad industry recognition of its threat. The domain resolves to IP address 13.248.243.5 and is registered through GoDaddy.com, LLC, with a creation date of November 18, 2013, which is unusually old for a phishing domain, suggesting the registrar may have been compromised or the domain repurposed. Its SSL certificate is issued by GoDaddy.com, Inc. / Go Daddy Secure Certificate Authority - G2, lending a false sense of legitimacy. The domain appears on 1 security blocklist, indicating limited but active detection.

As of the latest observation, the domain is offline, having been taken down likely due to reports or automated takedown processes. The response action appears successful, but residual risk remains as the infrastructure (IP, registrar) could be reused for similar attacks. Users who may have visited the site should change their Uphold credentials immediately and enable two-factor authentication. PhishDestroy advises caution with any unsolicited login pages and recommends always verifying URLs directly through official channels. The unique seed for this report is 90bd0d.