mail[.]uuphold[.]com

This domain, mail.uuphold.com, is identified as a phishing infrastructure specifically designed to impersonate Uphold, a legitimate cryptocurrency exchange platform. The site mimics login portals to harvest user credentials, financial details, and authentication tokens. Analysis indicates the domain is engineered to deceive victims into entering sensitive information under the false pretense of accessing their Uphold accounts, enabling subsequent unauthorized transactions or account takeovers.

Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on July 02, 2025, through Dynadot LLC, an unusually recent creation date for a purported financial service endpoint. It resolves to the IP address 34.111.26.73, hosted on Google LLC’s AS396982, yet lacks any SSL certificate, a critical security omission for financial platforms. VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist, further corroborating its fraudulent nature. The page title, 'Redirecting..,' suggests a transient or cloaked redirection mechanism, common in phishing campaigns to evade detection.

Users who visited mail.uuphold.com or entered credentials on the site should immediately revoke any active sessions on their legitimate Uphold accounts and enable multi-factor authentication. Monitor financial statements for unauthorized transactions and report suspicious activity to the platform’s official support channels. Reset passwords for any accounts where identical or similar credentials were reused, as phishing domains often exploit credential stuffing. Consider submitting the domain to additional threat intelligence platforms to enhance collective defense against this infrastructure.