uphold-guide-login[.]typedream[.]app

This domain, uphold-guide-login.typedream.app, is identified as a credential phishing site targeting users of the Uphold cryptocurrency wallet platform. The threat type is classified as high-risk credential harvesting, specifically designed to mimic the legitimate Uphold login interface to deceive victims into submitting sensitive account credentials. As of the latest verification, the domain has been taken offline, though prior activity remains documented for investigative purposes. Analysis indicates the domain was flagged by 12 of 95 security vendors on VirusTotal, with detection labels including social engineering and phishing. It resolves to the IP address 188.114.97.3 and is registered through Typedream, a platform enabling rapid deployment of web pages. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious infrastructure. The domain appears on three security blocklists, including MetaMask and PhishDestroy, and holds a Gridinsoft trust score of 0/100. Infrastructure analysis reveals the use of Node.js, React, Next.js, and Google Cloud services, alongside Cloudflare Browser Insights, suggesting a modern, cloud-based deployment. The domain is currently offline, reducing immediate risk to end users. However, organizations and individuals are advised to monitor for re-emergence under similar naming conventions or infrastructure. Network defenders should update blocklists to include the domain and associated IP address. Users who may have interacted with the site should reset credentials for Uphold and any other accounts where identical passwords were reused. Security teams are encouraged to review logs for connections to 188.114.97.3 and uphold-guide-login.typedream.app to identify potential compromise.