portal-uphold-io-web[.]square[.]site

This domain, portal-uphold-io-web.square.site, presents an elevated-risk brand impersonation threat targeting Uphold users. Analysis indicates the domain hosts a fraudulent login portal designed to mimic the legitimate Uphold authentication interface, specifically displaying the page title 'Log In | Uphold* : | Sign In to Your Account@ | Uphold Login.' The infrastructure is engineered to deceive users into submitting sensitive credentials, including usernames, passwords, and potentially multi-factor authentication codes, which are then harvested by threat actors for unauthorized account access or financial fraud. The domain's design and functionality closely replicate the legitimate Uphold platform, increasing the likelihood of successful deception among targeted users.

Technical evidence substantiates the malicious nature of this domain. According to aggregated threat intelligence, 12 out of 95 security vendors on VirusTotal flag this domain as malicious, indicating broad consensus among cybersecurity entities regarding its fraudulent purpose. The domain was registered on February 05, 2019, through MarkMonitor, Inc., a registrar commonly associated with both legitimate and malicious domains. It appears on one security blocklist, specifically PhishDestroy, and resolves to the IP address 74.115.51.5, hosted on autonomous system AS27647 (Weebly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (identifier E7), which, while providing encryption, does not validate the legitimacy of the domain's content or intent. The combination of these indicators—particularly the high detection rate on VirusTotal and the domain's presence on a security blocklist—confirms its classification as a high-confidence phishing infrastructure.

Users who have visited portal-uphold-io-web.square.site or entered credentials on this portal should take immediate remedial action. First, change passwords for Uphold and any other accounts where identical or similar credentials may have been reused. Enable multi-factor authentication on all critical accounts to mitigate the risk of unauthorized access. Monitor financial statements and account activity for signs of fraudulent transactions, and report any suspicious activity to the legitimate platform's support team. Additionally, consider running a full security scan on any devices used to access the fraudulent site to detect potential malware or keyloggers. Users should also verify the authenticity of any communications purporting to be from Uphold by directly accessing the official website via a trusted URL and avoiding links from emails or messages.