Union Pacific is a real railroad company with a history that goes back over a century, and its domain, up.com, has been registered since 1994. On the surface, that looks solid. But when we checked the site for basic security, we found a major problem: it doesn't use HTTPS. Every connection to the site is unencrypted, which means any login credentials or personal information you send could be seen by others. For a company that asks customers to sign in online, this is a serious gap. Most legitimate businesses today, especially those handling user accounts, encrypt their traffic as standard. The rest of the signals point to a genuine company — clean blacklists, transparent ownership, and legal pages all check out. But the lack of HTTPS on a site with a customer portal is hard to ignore. If you need to do business with Union Pacific, consider using their phone or a secure portal on a subdomain if one exists. For now, the main website raises real safety concerns for login use.
In plain English
Up.com is the legitimate website of Union Pacific Railroad, a real and well-known company. But the site does not use HTTPS at all, which is a severe security failure, especially since it offers a customer login. Until encryption is added, treat any data you enter here as unprotected.
What you should do now
Don't panic. These steps limit the damage, and the sooner you take them the better.
Don't enter any details
No passwords, card numbers or personal information — even if the site looks professional.
Close the tab
Especially if you got here from an email, text message or social media ad.
Already paid? Call your bank
Contact your bank or card provider right away. They can often stop or reverse a recent payment.
Warn others
Report the site and share this check with anyone who sent you the link.
Where the score comes from
The site does not support HTTPS at all, which is a critical flaw for any business that asks customers to log in or provide personal information. Without encryption, data sent over the connection is exposed.
The domain has been registered for 32 years under Union Pacific Railroad, a well-known American company. WHOIS records are clear and transparent, which is exactly what you'd expect from a major corporation.
The domain appears on no blacklists, has a clean Google Web Risk report, and has been archived on the Wayback Machine for nearly three decades. This is a long-established, legitimate business presence.
Union Pacific provides an About page, clear contact information, and active social media profiles. The site openly communicates who operates it and how to reach them.
Privacy policy and terms of service are published. While no Trustpilot profile exists, that's not unusual for a business in this sector. The legal pages meet expectations for a company of this size.
Email authentication (SPF and DMARC) is properly configured, and the domain's DNS setup is stable. DNSSEC is not enabled, but that's common and not a major concern here. The hosting network is the company's own.
What we checked
Think this verdict is wrong?
Site owners can request a fresh scan. Scores update automatically as signals change.