webs-uphold[.]wasmer[.]app

Analysis indicates that the domain webs-uphold.wasmer.app was registered on March 22 2026 through the Wasmer hosting platform. The domain resolves to the IPv4 address 62.210.172.162, which geolocates to France. Authoritative nameservers alpha.ns.wasmernet.com and beta.ns.wasmernet.com are listed, confirming the association with the Wasmer infrastructure. No TLS certificate is presented for the site, meaning traffic is served without encryption.

The page title returned from the host is “Uphold: Buy & Sell Crypto| Trade Digital Assets,” which references the legitimate Uphold brand and suggests a fake exchange campaign. The domain is currently offline, but historical observations show that it was classified as a generic phishing site with an elevated risk rating. Detection data from VirusTotal records that two of ninety‑four scanning engines flagged the domain, indicating a minority of security vendors recognized malicious behavior. Independent blocklist feeds have listed the host on three reputable sources: PhishDestroy, MetaMask, and SEAL, providing corroborating evidence of phishing activity.

The combination of a newly created domain, lack of TLS, alignment with a known brand in the title, and inclusion on multiple blocklists supports the conclusion that the domain was used for a fake cryptocurrency exchange scam. Uncertainty remains regarding the exact payload delivered, user‑interaction flow, and whether any additional infrastructure components were employed, as no further content analysis is available. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the IP address, and update threat‑intel feeds with the observed indicators of compromise. Continuous observation of the Wasmer name servers for new domains targeting the same brand is also recommended.