portal-uphold-com-doc[.]square[.]site

This domain, portal-uphold-com-doc.square.site, is flagged as an active credential phishing site targeting Uphold account holders. Analysis indicates the page title explicitly mimics Uphold's login portal ('Uphold Login | Secure Access to Your Uphold Account'), suggesting an intent to harvest user credentials. The domain resolves to 74.115.51.5, hosted on Weebly infrastructure in the US, and uses a Let's Encrypt SSL certificate (YE2). It is registered through MarkMonitor Inc. and utilizes AWS nameservers, a common pattern for phishing sites leveraging legitimate cloud services. Google Safe Browsing classifies the domain as social engineering, and it appears on three security blocklists, including PhishDestroy and MetaMask. Thirteen of 91 security vendors on VirusTotal detect the domain as malicious. Defenders should prioritize blocking this domain at the DNS or proxy level, as well as monitoring for internal access attempts. The site remains active as of July 19, 2026, with no evidence of takedown. No additional details about the phishing kit or exfiltration methods are currently available, so defenders should treat all interactions with this domain as high-risk.