helps-uphold-eng[.]square[.]site

PhishDestroy identifies an active Uphold® credential theft campaign hosted at helps-uphold-eng.square.site, a spoofed login page designed to harvest cryptocurrency wallet credentials from unsuspecting users. This domain mimics the legitimate uphold.com service with the exact page title 'Uphold® Login: Secure Access to Your Uphold Wallett' (note the misspelling of 'Wallet'), a tactic commonly used to bypass initial suspicion and increase click-through rates. The threat actor registered the domain through MarkMonitor Inc. on February 05, 2019, and maintains operational security by using a Let’s Encrypt SSL certificate to appear legitimate while hosting the fraudulent content on IP 74.115.51.4. Despite its age and active status, the page remains undetected by security vendors, with VirusTotal currently reporting 0 detections out of 95 engines — a critical window of opportunity for attackers to compromise user accounts before detection improves. This domain presents a high-risk threat to individuals and organizations relying on Uphold’s services, as it specifically targets login credentials with the intent to drain cryptocurrency wallets. Technical indicators confirm malicious intent: the domain resolves to IP 74.115.51.4, a known hosting environment frequently linked to phishing operations; the SSL certificate issued by Let’s Encrypt adds a veneer of authenticity, increasing the likelihood that victims will input sensitive data without hesitation. Registrar data via MarkMonitor and creation date of February 05, 2019, suggest this domain has evolved under threat actor control for over five years, enabling sustained abuse. The absence of detection (19/95 on VirusTotal as of current assessment) highlights the sophistication of the campaign in evading automated defenses, requiring immediate user vigilance and enterprise-level blocking. Users who visited helps-uphold-eng.square.site or interacted with the fraudulent login form should immediately revoke session access on all devices, change passwords on Uphold and related email accounts, and enable two-factor authentication (2FA) using a hardware key or authenticator app. Review recent transaction history for unauthorized activity and report any suspicious transfers to Uphold support and relevant financial authorities. Block the domain and IP (74.115.51.4) at the network firewall level to prevent further exposure. If credentials were entered, contact Uphold’s fraud team immediately and consider transferring remaining funds to a cold wallet. Always verify URLs visually or via official Uphold channels before entering login information.