uppholdlogex-wlu8[.]godaddysites[.]com

This domain, uppholdlogex-wlu8.godaddysites.com, is flagged as a generic_phishing site impersonating Uphold, a cryptocurrency platform. The page title, "Ûphold Login | Sign In," confirms the intent to deceive users into submitting credentials. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for retrospective analysis. Analysis indicates the domain was registered through GoDaddy.com, LLC, with an SSL certificate issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2. It resolves to IP address 13.248.243.5, hosted on Amazon.com, Inc. infrastructure (AS16509). The domain was created on February 21, 2026, an anomalous date suggesting potential manipulation or misconfiguration. VirusTotal reports 16 of 95 security vendors flagging the domain as malicious, while it appears on a single blocklist. The infrastructure analysis reveals a low-trust profile, with no legitimate association to the impersonated brand. The domain is currently offline, reducing immediate risk to users. However, organizations should block the domain and its resolving IP (13.248.243.5) at the perimeter to prevent potential resurgence. Security teams are advised to monitor for credential theft attempts linked to this campaign, particularly targeting Uphold users. Logs should be reviewed for prior connections to the domain or IP, and affected users should be prompted to reset credentials. The anomalous creation date warrants further investigation into registrar abuse or domain spoofing techniques.