www-up-hold[.]live

Analysis on www-up-hold.live indicates the site is currently offline but remains listed as a brand‑impersonation threat targeting the cryptocurrency service scroll. The domain resolves to the Cloudflare edge address 104.21.78.169, situated in the United States under ASN 13335, confirming use of Cloudflare’s global CDN. Registration details show the domain is hosted through Cloudflare, Inc., with authoritative nameservers dana.ns.cloudflare.com and seamus.ns.cloudflare.com. No TLS certificate is presented, meaning HTTPS is not enforced.

VirusTotal scans have returned 13 positive detections out of 95 vendors, and the domain appears on a single security blocklist. Additionally, PhishDestroy has explicitly blocked the domain. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. The page title retrieved from the site, “Uphold Educational | Learn About Security & Innovation,” does not align with the impersonated brand scroll, suggesting a deliberate attempt to mislead users by referencing a legitimate‑sounding educational resource.

While the site is offline at the time of this report, the infrastructure footprint indicates that the operators leveraged Cloudflare’s services to obscure origin servers and to benefit from the provider’s performance network. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for re‑activation, and add the IP address 104.21.78.169 to threat‑intel feeds. Continuous re‑scanning with multi‑vendor engines is advised to capture any changes in detection status. Users should be warned that any unsolicited communication claiming to be from scroll that directs to this domain is malicious.