bnb[.]uphold[.]qpon

Analysis of the domain bnb.uphold.qpon indicates a confirmed brand impersonation campaign targeting WhatsApp users, classified as elevated risk. The domain was registered on February 21, 2026, and has since been flagged by 11 of 93 security vendors on VirusTotal, with a listing on the PhishDestroy blocklist. Infrastructure analysis reveals the domain resolved to IP address 104.21.29.203, hosted on Cloudflare's network (AS13335) in the United States. The SSL certificate is issued by WE1, a provider often associated with low-cost or automated certificate issuance, which may align with threat actor infrastructure patterns.

The page title, 'Uphold MINING- Cloud Mining Platform,' suggests an attempt to mimic a cryptocurrency mining service, though the stated brand target remains WhatsApp, indicating possible dual-purpose deception or misdirection. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as malicious. The domain is currently offline, limiting further real-time verification of its content or operational status.

Defenders should treat this domain as a confirmed phishing threat, particularly for campaigns impersonating WhatsApp or leveraging cryptocurrency-themed lures. While the exact content of the site remains unanalyzed due to its offline status, the combination of brand impersonation, low-cost hosting infrastructure, and detection by multiple security vendors provides sufficient evidence for blocking and monitoring. No additional threat intelligence or open-source reporting on this domain has been identified as of the report date.