upholld-public-log[.]daftpage[.]com

This domain, upholld-public-log.daftpage.com, is actively flagged as a high-risk brand impersonation site targeting users of a cryptocurrency platform. Registered on October 24, 2021, through OVH, SAS, the domain resolves to IP address 216.150.1.1 and presents a page titled 'Uphold Log-in || Sign In to Your Account,' directly mimicking the login interface of the targeted brand. Infrastructure analysis reveals the use of Next.js, React, Node.js, and Vercel, alongside HSTS, Google Analytics, and Crisp Live Chat, indicating a structured and potentially persistent phishing operation. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, and does not serve as an indicator of trustworthiness in this context. The domain is blocked by at least two security blocklists, including PhishDestroy and PhishingDB, and holds a Gridinsoft trust score of 0/100. While 11 out of 95 security vendors on VirusTotal flag the domain as malicious, the absence of detections from other vendors does not confirm safety. The domain remains active as of July 12, 2026, with no evidence of takedown or remediation efforts. Defenders should treat this domain as hostile infrastructure. Immediate actions include blocking the domain and its resolving IP at the network perimeter, alerting users to avoid interaction, and monitoring for credential submissions or secondary payload delivery. The presence of live chat functionality suggests potential real-time attacker engagement, increasing the risk of tailored social engineering. Given the domain's age and continued activity, it may be part of a larger campaign; defenders should review logs for prior connections and correlate with other indicators associated with this infrastructure.