h5[.]idn-uphold[.]org

This domain, h5.idn-uphold.org, is identified as a high-risk phishing site leveraging Internationalized Domain Name (IDN) techniques to impersonate Uphold, a legitimate cryptocurrency platform. The page title "IDN" and the domain structure suggest an attempt to deceive users into believing they are interacting with the official Uphold service. No specific drainer kit signatures were observed, but the domain exhibits characteristics typical of credential harvesting or wallet compromise schemes targeting cryptocurrency users. Analysis indicates the domain resolves to the IP address 188.114.96.3, hosted by CloudFlare, Inc. in Canada. It was registered on March 20, 2026, through GoDaddy.com, LLC, an unusually future-dated registration likely intended to evade immediate detection. VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly designates it as phishing. The domain appears on three security blocklists, and its SSL certificate, issued by Let's Encrypt (serial number E7), does not mitigate the threat due to the domain's inherent malicious intent. As of the latest assessment, h5.idn-uphold.org has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a potential threat if reactivated or repurposed. Organizations are advised to block the domain and its resolving IP at the perimeter, monitor for related IDN homograph attacks, and educate users on verifying domain authenticity before entering credentials or wallet information. Future registrations under similar IDN patterns should be scrutinized for phishing indicators.