uphold-io[.]meku[.]app

This domain, uphold-io.meku.app, is actively engaged in credential theft operations targeting users of the Uphold financial platform. Analysis indicates the infrastructure impersonates the legitimate Uphold login portal, as evidenced by the page title 'Uphold | Login' and the domain structure designed to mimic authentic branding. The threat actor appears to be harvesting login credentials, likely for subsequent unauthorized account access or financial fraud, though no specific drainer kit signatures have been confirmed at this time.

Infrastructure analysis reveals the domain resolves to IP address 98.84.224.111, hosted on AS14061 (DigitalOcean, LLC) in the United States. The domain is registered through Porkbun LLC, though no precise creation date is currently available. Security telemetry shows the domain is flagged by 19 out of 95 vendors on VirusTotal, with active listings on three security blocklists. The SSL certificate is issued by Let's Encrypt (serial number E8), a common practice among threat actors to lend superficial legitimacy. Google Safe Browsing status remains unconfirmed, though the domain is actively blocked by multiple independent security providers.

Current status indicates the phishing infrastructure remains operational, with no evidence of takedown or disruption. The domain continues to resolve and present the fraudulent login interface as of the latest verification. Given the active credential harvesting activity, immediate response actions are warranted, including domain suspension via registrar abuse channels and IP-based network blocking. Remaining risk is assessed as high due to the domain's persistence, brand impersonation effectiveness, and demonstrated capability to evade detection by a majority of security vendors. Users are advised to verify domain authenticity before entering credentials and implement multi-factor authentication to mitigate account compromise risks.