portal-up-hold-helps[.]square[.]site

Portal-up-hold-helps.square.site is currently active and resolves to 74.115.51.5, an address owned by Weebly, Inc. in the United States. The domain was registered on May 13, 2026 through MarkMonitor Inc. and is hosted on the Square site platform, as indicated by the “square.site” suffix and the four Amazon Route 53 name servers (ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, ns-... ). The TLS certificate is issued by Let’s Encrypt (E8), confirming the use of a free certificate authority. HTTP requests return a 200 status and the page title reads “Log In | Uphold®: | Sign In to Your Account”, matching the declared brand target “uphold” and the credential‑phishing classification. Google Safe Browsing flags the site for social engineering, and six of ninety‑two VirusTotal scanners have reported it as malicious. Independent blocklists from PhishDestroy, MetaMask, and SEAL also list the domain, and Gridinsoft assigns a trust score of 0 / 100. The evidence collectively indicates a high‑risk brand‑impersonation campaign aimed at harvesting Uphold credentials. Uncertainty remains regarding the full page content and any additional malicious payloads, as no visual analysis is available. Defenders should block DNS resolution to the domain, add the IP address 74.115.51.5 to deny‑list rules, and monitor for authentication attempts against Uphold accounts originating from this infrastructure. Continuous surveillance of related Square‑site subdomains and the observed name server set is recommended to detect future replicas.