uphold[.]techinsgroup[.]co

Analysis indicates that uphold.techinsgroup.co is associated with a fake login phishing operation involving brand impersonation. The page title observed on the site is "Uphold", suggesting an attempt to mimic a recognizable online platform and capture user credentials or account-related information. The domain is currently active and remains accessible at the time of assessment. Based on the available indicators and the active status of the infrastructure, the risk level is assessed as high.

Technical review shows that the domain is flagged by 4 of 95 VirusTotal vendors and appears on 3 separate security blocklists. Registration records indicate that the domain was created on April 02, 2026 and registered through Hosting Concepts B.V. d/b/a Registrar.eu. DNS resolution maps the domain to IP address 18.228.42.232. The site is protected by a Let's Encrypt / E8 SSL certificate, a common certificate authority configuration that provides encryption but does not validate legitimacy. Independent security controls have already blocked the domain, including detections from PhishDestroy, MetaMask, and SEAL. The combination of recent registration, multiple blocklist appearances, security vendor detections, and impersonation indicators increases confidence in the phishing classification.

The domain remains active and should be treated as hostile infrastructure. Users and organizations should avoid submitting credentials, authentication codes, wallet information, or other sensitive data through this site. Network defenders should consider blocking access to uphold.techinsgroup.co and the associated IP address 18.228.42.232, monitoring logs for historical connections, and investigating any authentication attempts linked to the domain. Security teams should also review email, browser, and proxy telemetry for evidence of user interaction. Given the active status, confirmed blocklist presence, and multiple security detections, continued monitoring and immediate preventive controls are recommended.