upholdl0giin[.]webflow[.]io

Analysis of the domain upholdl0giin.webflow.io indicates a high-risk phishing operation targeting users of the legitimate Uphold cryptocurrency and digital asset trading platform. The domain, registered through Webflow, currently resolves to IP address 172.64.151.8 and is actively flagged by multiple security mechanisms. Infrastructure analysis reveals the use of Webflow hosting and Cloudflare protection, including HTTP/3 support, which may complicate takedown efforts and obscure origin details. The page title, 'Uphold: Buy & Sell Crypto & Metals | Trade Digital Assets,' directly mirrors the branding of the authentic Uphold service, suggesting an intent to deceive users into believing the site is legitimate. As of July 12, 2026, the domain appears on four security blocklists, including OpenPhish and SEAL, and is explicitly blocked by MetaMask and PhishDestroy. Google Safe Browsing has classified the site as engaging in social engineering. The SSL certificate is issued by Google Trust Services, which does not inherently indicate malicious intent but is consistent with infrastructure used by both legitimate and fraudulent sites. While 17 of 95 security vendors on VirusTotal flag the domain, this detection rate alone does not confirm the specific nature of the threat beyond its classification as phishing. The exact content and functionality of the site remain unanalysed, and there is no confirmed evidence of credential harvesting, wallet-draining scripts, or other payloads. Defenders should treat this domain as an active threat and prioritise blocking at the network and endpoint levels. Organisations are advised to monitor for connections to 172.64.151.8 and alert users who may have interacted with the site. Given the use of Webflow and Cloudflare, takedown requests should be directed to both the hosting provider and the content delivery network.