ss-uphold-app[.]dream[.]space

This domain, ss-uphold-app.dream.space, is flagged for brand impersonation targeting the Uphold cryptocurrency platform. Analysis indicates the site mimics the legitimate Uphold login interface, presenting a page titled 'Log In® | Uphold™' to deceive users into entering credentials. No explicit cryptocurrency drainer kit signatures were detected, but the domain’s infrastructure and page content strongly suggest credential harvesting or subsequent financial fraud. The impersonation targets users familiar with Uphold’s branding, leveraging visual and functional replication to lower suspicion. Technical indicators confirm elevated risk. The domain was registered on February 21, 2026, through Go Daddy, LLC, and resolves to the IP address 104.18.21.20, a Cloudflare-hosted endpoint. VirusTotal reports 8 out of 95 security vendors flagging the domain as malicious. The domain appears on three independent security blocklists, and Gridinsoft assigns it a trust score of 0/100. The SSL certificate is issued by Google Trust Services, and detected technologies include Three.js, ECharts, Tailwind CSS, jsDelivr, HSTS, cdnjs, and Cloudflare, which are consistent with modern phishing infrastructure designed to evade detection and appear legitimate. The domain remains active and poses a continued threat to users. Response actions include blocking at the network and endpoint levels, as evidenced by prior detections from MetaMask, SEAL, and PhishDestroy. Despite these mitigations, the domain’s low detection rate on VirusTotal (8/95) and use of Cloudflare’s CDN complicate takedown efforts. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication on financial platforms, and cross-reference URLs with official sources. Organizations should update blocklists to include this domain and monitor for related infrastructure reuse.