upbytetrade[.]com

This domain, upbytetrade.com, is identified as a cryptocurrency phishing site targeting users through deceptive interfaces mimicking legitimate cryptocurrency platforms. The domain is currently offline but was previously active in phishing operations designed to harvest credentials, private keys, or wallet recovery phrases. The page title, UPBYTE, suggests an attempt to impersonate or resemble established cryptocurrency services, though no direct brand impersonation was confirmed in available metadata. Analysis indicates the domain was flagged by 9 of 95 security vendors on VirusTotal, reflecting broad detection across multiple threat intelligence sources. It was registered through Gname.com Pte. Ltd. on November 10, 2025, and resolved to the IP address 172.67.191.40, hosted on AS13335 (Cloudflare, Inc.) infrastructure in the United States. The domain appears on three security blocklists, and its SSL certificate was issued by Let’s Encrypt (R13). Infrastructure analysis reveals the use of content delivery network services, a common tactic to obscure hosting origins and evade takedown efforts. The domain’s current offline status reduces immediate risk, though historical activity and infrastructure reuse remain concerns. Organizations and individuals are advised to block the domain and its associated IP (172.67.191.40) at the network level. End-users should verify cryptocurrency platforms via official channels and avoid interacting with domains created within the last 90 days, particularly those with low reputation scores or recent registration dates. Monitoring for related domains registered through the same registrar or resolving to the same IP range is recommended for proactive defense.