upholdsigninlog[.]wordpress[.]com

Analysis of upholdsigninlog.wordpress.com indicates that the domain is being used for credential phishing targeting users of the Uphold asset management platform. The site presents a page title that references “Uphold Login Basics | Seamless Asset Management and Trading,” which aligns with the reported investment‑scam classification. Infrastructure data show the domain resolves to IP 192.0.78.12, an address owned by Automattic, Inc. (ASN 2635) and located in the United States. The domain is served through WordPress‑hosted nameservers ns1‑ns4.wordpress.com and employs a Let’s Encrypt (E8) TLS certificate, modern web stack components including Nginx, PHP, MySQL, HSTS and HTTP/3.

Registration records reveal creation on 3 March 2000 via MarkMonitor, Inc., and the site is currently returning HTTP 410, indicating it has been taken offline. VirusTotal scans report nine detections out of ninety‑five security vendors, and the domain appears on a single blocklist, currently listed by PhishDestroy. The combination of a brand‑specific page title, elevated risk rating, and multiple vendor detections suggests the domain was actively leveraged for credential harvesting.

Uncertainty remains regarding the exact content that was served before takedown, as no visual or form details are available. Defenders should add the domain to deny‑list rules, monitor for any resurgence of the same sub‑domain pattern, and consider tightening inbound traffic filters for WordPress‑hosted assets that reference financial services. Continuous observation of related IP ranges and registrar activity is advised to detect potential re‑registration attempts.