uphold-login-accounyt[.]webflow[.]io

This domain, uphold-login-accounyt.webflow.io, operates as a credential theft scam designed to harvest login credentials from users under the guise of a legitimate financial service platform. Analysis indicates the site mimics trusted interfaces to deceive visitors into entering sensitive account details, which are then exfiltrated to attacker-controlled infrastructure. The threat specifically targets users of cryptocurrency and digital asset management services, exploiting familiarity with such platforms to increase the likelihood of successful compromise. Evidence supporting this assessment includes detection by 19 out of 95 security vendors on VirusTotal, indicating widespread recognition of its malicious nature. The domain was registered through Webflow on March 07, 2026, and is hosted on Cloudflare infrastructure (AS13335) with an IP resolution of 172.64.151.8. It appears on three security blocklists, including those maintained by anti-phishing and browser security entities. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as it is commonly used by both legitimate and malicious sites to encrypt traffic. Users who visited this domain should assume their credentials were compromised if they entered any login details. Immediate action is required: revoke any active sessions on the legitimate platform being impersonated, enable multi-factor authentication if not already in use, and monitor accounts for unauthorized transactions or changes. Passwords for the affected account and any reused credentials should be changed across all services. Network-level indicators, such as the domain and resolving IP, should be blocked in enterprise environments to prevent further exposure. If financial transactions were initiated, contact the relevant institution to report potential fraud and freeze affected assets.