logne-uphold-com[.]pages[.]dev

This domain, logne-uphold-com.pages.dev, was identified as a credential theft operation targeting users of the Uphold cryptocurrency platform. The site impersonated the legitimate Uphold login portal, presenting a fraudulent interface designed to harvest user credentials, including usernames, passwords, and potentially multi-factor authentication codes. Given the financial nature of the targeted platform, stolen credentials could enable unauthorized access to digital wallets, leading to asset theft or further exploitation through social engineering or malware deployment. Analysis indicates the domain was flagged by 12 out of 95 security vendors on VirusTotal, signaling widespread detection as malicious. Infrastructure analysis reveals the domain was registered through Cloudflare on April 12, 2026, an unusually future-dated creation that may indicate an attempt to evade detection or appear legitimate. The domain resolved to the IP address 172.66.47.97 and was hosted behind Cloudflare’s network, leveraging HTTP/3 and HSTS to mimic secure connections. It appeared on three security blocklists and was actively blocked by multiple threat intelligence feeds, further confirming its malicious intent. Users who visited logne-uphold-com.pages.dev or entered credentials on the site should assume their login details were compromised. Immediate actions include resetting passwords for Uphold and any other platforms where the same credentials were reused. Enable multi-factor authentication on all accounts, particularly those linked to financial services. Monitor account activity for unauthorized transactions or logins, and review connected devices or sessions for signs of compromise. If financial assets were accessed, report the incident to the platform and relevant authorities for further investigation.