upshub[.]app

The domain upshub.app was registered on April 29, 2026 through Name.com, Inc. and currently resolves to the IP address 185.158.133.1, which belongs to Cloudflare, Inc. (AS13335) located in Poland. The site serves a page titled “Manage Customer Orders With UPS Marketplace Shipping,” explicitly targeting the UPS brand. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, indicating use of a valid TLS certificate. HTTP requests receive a 302 redirect response, and the service advertises HSTS support. The domain is listed on a single security blocklist and has been flagged by PhishDestroy. VirusTotal reports 20 of 91 security vendors flagging the domain as malicious. Google Safe Browsing classifies the URL under the “SOCIAL_ENGINEERING” category. The nameserver set consists of ns1hwy.name.com, ns2fln.name.com, ns3fqs.name.com, and ns4jnz.name.com. The Gridinsoft trust score is 0/100, reinforcing the malicious assessment. The infrastructure indicates a typical brand‑impersonation operation that leverages reputable TLS and Cloudflare front‑end services to increase credibility. While the exact page content beyond the title has not been examined, the combination of brand targeting, redirect behavior, and multiple vendor detections suggests an active phishing campaign aimed at harvesting UPS customer credentials or payment information. Defenders should block the domain at DNS and proxy layers, monitor for outbound connections to 185.158.133.1, and update detection signatures to include the observed redirect pattern and the specific page title. Continuous observation is advised to capture any changes in payload or additional infrastructure components.