uphold-web[.]pop[.]site

The domain uphold-web.pop.site remains active as of the report date and is classified under generic phishing. It was registered on February 13 2025 through GoDaddy.com LLC and currently resolves to IP address 76.76.21.142 located in the United States under AS16509. The domain uses nameservers ns05.domaincontrol.com ns06.domaincontrol.com ns1.vercel-dns-3.com and ns2.vercel-dns-3.com and returns HTTP status 200. SSL certificate details show issuance by Let's Encrypt under the YR2 profile. Infrastructure analysis reveals deployment via Node.js React Vercel Next.js along with HSTS Google Analytics and Webpack. The page title matches uphold-web indicating direct impersonation of the Uphold service. Analysis indicates the domain appears on three security blocklists and carries a Gridinsoft trust score of 0 out of 100. VirusTotal reports detections from nine out of ninety five vendors. It is already listed by PhishDestroy MetaMask and SEAL. The combination of recent registration low trust score and confirmed blocklist presence supports the high risk level assigned to this entry. What remains uncertain is the precise duration of active operation since the first detection date is not recorded in available data. Defenders should block the IP 76.76.21.142 at network perimeters and add the full domain uphold-web.pop.site to internal deny lists. Organizations should monitor traffic to the listed nameservers and review logs for connections originating from this address. Incident responders are advised to inspect any captured pages for credential harvesting forms and to cross reference user reports against the observed page title. Continued observation of the domain status is warranted given its current active classification and the generic phishing threat type.