uppholdlogin[.]gitbook[.]io

The domain uppholdlogin.gitbook.io is active and was registered on February 21, 2026. DNS resolution points to IP address 172.64.147.209, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. The domain is hosted on the GitBook platform and uses Cloudflare's DNS service (nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com) with HSTS, Google Cloud Trace, and HTTP/3 enabled. An SSL certificate issued by Google Trust Services under the WE1 label secures the site. HTTP requests receive a 307 temporary redirect response, suggesting a possible URL forwarding step in the phishing flow. Google Safe Browsing classifies the site under the SOCIAL_ENGINEERING category, and 19 of 95 security vendors on VirusTotal have flagged it as malicious. The domain appears on one public blocklist and is actively blocked by PhishDestroy. The page title observed is "Ûphold Loℊin | Sign In 💎", indicating an attempt to impersonate the Uphold login portal. While the exact content of the landing page has not been analyzed, the technical indicators collectively point to a credential‑phishing infrastructure targeting Uphold users. Defenders should block DNS resolution for uppholdlogin.gitbook.io, add the domain to web filtering and email security policies, and monitor for any authentication attempts to Uphold accounts originating from this host. Continuous threat‑intel feeds should be consulted for any updates on related indicators of compromise.