share[.]upscrolled[.]com

share.upscrolled.com is currently flagged as an active brand‑impersonation infrastructure targeting the “foundation” brand. The domain was registered through GoDaddy.com, LLC on 21 February 2026 and resolves to the IPv4 address 160.153.0.143, which belongs to AS397273 (Render) located in the United States. DNS resolution is performed by the authoritative name servers pdns11.domaincontrol.com and pdns12.domaincontrol.com, both associated with GoDaddy’s default hosting pool. The site presents an HTTP 307 temporary redirect response and serves a TLS certificate issued by Google Trust Services under the WE1 trust anchor, indicating the use of a legitimate certificate chain.

Content analysis reveals a WordPress stack augmented with Apple iCloud Mail integration, MySQL, PHP, Google Sign‑in, Yoast SEO, Swiper, and jQuery Migrate, suggesting a generic web‑application framework rather than a bespoke phishing kit. The page title “UpScrolled — your voice amplified!” is unrelated to the claimed impersonation of the foundation brand, and no further page content has been disclosed. Reputation data shows the domain appears on one external security blocklist and has been added to the PhishDestroy blocklist. VirusTotal reports indicate that the domain was examined by 93 scanning engines, none of which returned a detection at the time of analysis.

No public Safe Browsing, OTX, or additional threat‑intel entries are presently linked to the host. Uncertainty remains regarding the specific phishing workflow, credential‑capture mechanisms, and the lifecycle of the campaign. Defenders should block the domain at perimeter firewalls and proxy filters, monitor DNS queries for the associated IP and name servers, and include the domain in threat‑intel feeds. Ongoing observation of the hosting provider’s activity and periodic rescanning with multi‑engine services are recommended to detect any future malicious payloads or changes in behavior.