up--hold--login[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting cryptocurrency wallet users. Analysis indicates the infrastructure was specifically designed to mimic MetaMask, a widely used digital asset management platform, with the intent to harvest credentials or facilitate unauthorized transactions. The page title, 'Uphold Account Login - Secure Access | Official Financial Hub,' further reinforces the deception by misrepresenting the service as a legitimate financial portal, a common tactic in cryptocurrency-related phishing campaigns. Infrastructure analysis reveals the domain up--hold--login.pages.dev was registered on October 25, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3. The domain is currently offline but was previously flagged by 13 out of 95 security vendors on VirusTotal, with detections categorized under 'SOCIAL_ENGINEERING' by Google Safe Browsing. It appears on three security blocklists and is blocked by multiple threat intelligence feeds. The SSL certificate is issued by Google Trust Services, and the site employed security technologies such as HSTS and HTTP/3, likely to enhance the appearance of legitimacy. Mitigation for this type of threat involves immediate verification of domain authenticity before entering sensitive information. Users should cross-reference URLs with official sources and avoid interacting with pages that deviate from documented domain structures. Organizations should update blocklists to include this domain and its associated IP, while monitoring for similar impersonation attempts using the same registrar or hosting patterns. Cryptocurrency wallet users are advised to enable multi-factor authentication and verify transaction requests through secondary channels to prevent unauthorized access or asset drainage.