upholdcapital[.]vip

This domain, upholdcapital.vip, is identified as a cryptocurrency credential harvesting site targeting users of the Uphold platform. Analysis indicates the phishing page mimics the legitimate Uphold interface, likely designed to capture login credentials, private keys, or recovery phrases under the guise of account verification or security updates. The site employs modern web technologies, including Node.js, React, Next.js, and Webpack, which may be used to obfuscate malicious functionality or dynamically serve phishing content based on user interaction. Technical indicators confirm the domain’s malicious nature. VirusTotal reports 16 out of 95 security vendors flagging upholdcapital.vip as malicious. The domain was registered through NAMECHEAP INC on December 24, 2025, an unusually future-dated creation timestamp that may indicate an attempt to evade detection or appear legitimate. It resolves to the IP address 75.119.138.228 and is currently flagged by Google Safe Browsing for social engineering. The domain appears on four security blocklists, including MetaMask, PhishDestroy, SEAL, and InversionDNS, further corroborating its phishing intent. As of the latest assessment, upholdcapital.vip has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, the infrastructure remains a residual risk. The domain’s future-dated registration suggests potential for re-activation or migration to new hosting. Organizations and individuals are advised to block the domain and its resolving IP at the network level, monitor for related phishing campaigns, and educate users on recognizing cryptocurrency credential harvesting tactics. Persistent vigilance is recommended, as threat actors may re-deploy the phishing kit under a new domain or IP address.