up-hold-guide[.]pages[.]dev

PhishDestroy has identified up-hold-guide.pages.dev as a malicious site designed to steal login credentials from Uphold cryptocurrency exchange users. The page displayed a convincing "Login to Uphold | Beginner’s Guide to Your Account" interface, tricking visitors into entering their usernames and passwords. This type of attack, known as credential theft or brand impersonation, can lead to account takeover and loss of funds if victims fall for the lure.

The evidence against this domain is strong. VirusTotal analysis shows that 6 out of 95 security vendors flagged it as malicious. The domain was created just recently on April 24, 2026, and is registered through Cloudflare, Inc., a common provider for phishing sites that want to hide behind a legitimate CDN. It resolved to IP 188.114.96.3 and used an SSL certificate from Google Trust Services, giving it a false sense of security. The site has since been taken offline, but the threat remains for anyone who may have visited earlier.

If you entered any information on this site, act immediately. Change your Uphold password and enable two-factor authentication (2FA) if you haven't already. Contact Uphold support to report the incident and monitor your account for suspicious activity. Also scan your device for malware, as phishing pages sometimes drop additional threats. Stay vigilant—always verify URLs before logging in and use a password manager to avoid typosquatting attacks like this one.