uphold-log-in[.]tem3[.]io

Analysis as of July 24 2026 indicates that the domain uphold-log-in.tem3.io is currently active and was registered through GoDaddy.com, LLC on August 02 2024. The authoritative name servers are justin.ns.cloudflare.com and val.ns.cloudflare.com, pointing the domain to the Cloudflare network. DNS resolution returns the IPv4 address 188.114.97.3, which is hosted on a Cloudflare edge node. No TLS certificate details are available in the supplied intelligence, and HTTP response information has not been published, so the presence of HTTPS or any redirect behavior remains unverified.

The domain has been flagged by the PhishDestroy blocklist and appears on one additional security blocklist, confirming that at least one external threat-intel source has observed malicious use. VirusTotal reports that the domain was scanned by 91 AV engines, none of which raised a detection at the time of the scan; this absence of detections does not constitute evidence of benign intent. The lack of public Safe Browsing or Open Threat Exchange (OTX) entries further limits visibility into community-wide reputation. Given the domain name, which incorporates the term “log-in”, and the blocklist markings, the most plausible activity is credential-harvesting phishing, although no payload samples, landing-page screenshots, or observed credential submissions have been disclosed.

Consequently, the exact phishing kit, targeted brand, or victim geography cannot be confirmed at this stage. Defenders should treat uphold-log-in.tem3.io as a high-confidence malicious indicator. Recommended actions include adding the domain to outbound and inbound DNS deny lists, updating web-proxy and firewall rule sets to block HTTP/S traffic to the IP 188.114.97.3, and monitoring for any authentication attempts or credential submissions that reference the domain. Continuous re-evaluation is advised, as future scans may yield detections or additional intelligence from threat-sharing platforms.