up-held-login-web[.]pages[.]dev

This domain is flagged as a high-risk credential phishing infrastructure specifically targeting users of the Uphold cryptocurrency wallet. Analysis indicates the site masquerades as a legitimate crypto exchange, NovaTrade, to harvest login credentials and facilitate unauthorized transfers. The threat type is narrowly defined as crypto-focused credential phishing, with the page title explicitly referencing seamless transfers from Uphold Wallet, a clear social engineering tactic to exploit user trust in familiar services. Infrastructure analysis reveals the domain up-held-login-web.pages.dev was registered on May 03, 2026, through Cloudflare, Inc. It resolves to the IP address 188.114.97.3, geolocated to Canada and associated with Cloudflare’s network infrastructure. The domain appears on one security blocklist and is flagged by Google Safe Browsing as phishing. VirusTotal reports 10 out of 95 security vendors detecting the domain as malicious, with an SSL certificate issued by Google Trust Services (WE1). The combination of recent registration, Cloudflare hosting, and low detection rates among vendors suggests an attempt to evade automated detection while maintaining operational security. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate fingerprint into endpoint detection and response (EDR) systems. Users should be educated on recognizing crypto phishing tactics, particularly those impersonating wallet services or exchanges. Multi-factor authentication (MFA) should be enforced for all cryptocurrency-related accounts to mitigate the impact of credential theft. Given the domain’s active status, continuous monitoring for related infrastructure, such as newly registered lookalike domains or similar SSL certificates, is recommended to preempt further attacks.