upholld-xlog[.]godaddysites[.]com

This domain, upholld-xlog.godaddysites.com, operates as a credential phishing site targeting users of a cryptocurrency platform. The page title, 'Uphold | Login to my Account,' directly mimics the legitimate login interface of Uphold, a known digital asset platform, to deceive users into submitting their account credentials. The intent is to harvest sensitive login details, which can lead to unauthorized account access, financial theft, or further exploitation through secondary attacks such as malware distribution or identity fraud. Analysis indicates this domain is registered through a widely used registrar and was created on November 18, 2013, though its malicious use appears to be recent. It resolves to the IP address 76.223.105.230 and is flagged by 15 out of 95 security vendors on a major threat intelligence platform. The domain appears on three security blocklists and is actively blocked by multiple browser-based security extensions. The SSL certificate is issued by the same registrar, which is consistent with common phishing infrastructure tactics to appear legitimate. Users who visited this domain or entered credentials should immediately revoke any active sessions on the legitimate platform and change their passwords. Multi-factor authentication (MFA) should be enabled if not already active. Any devices used to access the site should be scanned for malware, and browser sessions should be cleared to remove stored credentials. If financial transactions were initiated, affected users should contact their financial institution to monitor for unauthorized activity and consider placing fraud alerts on their accounts.