SafeMode - Analysis: web-uphold-login-cdn.tem3.io

Visual Capture

Screenshot of web-uphold-login-cdn.tem3.io

Detection Info

http://web-uphold-login-cdn.tem3.io

Detected Brand

Uphold

Country

International

Confidence

100%

HTTP Status

200

Report ID

a7c063e8-b75…

Analyzed

2026-07-14 11:25

Final URL (after redirects)

http://web-uphold-login-cdn.tem3.io/

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T194B22229330813691D6710D291D933EAB329F63D77121DE07899C6B5CBAE6BBB031ED4
CONTENT ssdeep	768:FSRWDJd08mEZE/m4R+7id1pTR8pAjNaLG:MFw8RsUDR8W9

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	bdc1c23cc3693c96
VISUAL aHash	ffff83c38383c3ff
VISUAL dHash	0237071717073700
VISUAL wHash	ffc381818181c3ff
VISUAL colorHash	17030000080
VISUAL cropResistant	0237071717073700,e30b173333173737

Code Analysis

Risk Score 97/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Credential Phishing
• Target: Uphold users
• Method: Brand impersonation via site builder
• Exfil: Credential harvesting via obfuscated scripts
• Indicators: Domain mismatch, use of 'tem3.io' domain
• Risk: Critical account compromise

🔒 Obfuscation Detected

atob
eval
fromCharCode
unescape
unicode_escape

🎯 Kit Endpoints

https://web-uphold-login-cdn.tem3.io

📡 API Calls Detected

GET
POST

📊 Risk Score Breakdown

Total Risk Score

95/100

Contributing Factors

Domain Analysis

Non-official domain using site builder.

JS Analysis

Detected obfuscated exfiltration scripts.

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

Uphold users (International)

Attack Method

Brand impersonation + obfuscated JavaScript

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
12 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand

Uphold

Official Website

https://uphold.com

Fake Service

Uphold Exchange Login

Fraudulent Claims

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The site clones the legitimate Uphold UI to trick users into entering credentials. The input is then captured by obfuscated JavaScript.

Secondary Method: Brand Impersonation

Uses logos and aesthetic design to build false trust.

Target Blockchain

N/A

🌐 Infrastructure Indicators of Compromise

Domain Information

Domain

tem3.io

Registered

2022-09-20

Registrar

Unknown

Status

Active

🤖 AI-Extracted Threat Intelligence

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Uphold

http://secure-uphlld-logu.tem3.io

Jul 14, 2026