build-uphold[.]created[.]app

This domain, build-uphold.created.app, operates as a credential theft platform specifically designed to impersonate the Uphold digital wallet login interface. Analysis indicates the site mimics the authentic Uphold authentication portal, presenting users with a seemingly legitimate login form to harvest account credentials, including usernames, passwords, and potentially multi-factor authentication codes. The threat extends beyond simple phishing, as compromised credentials could enable unauthorized access to cryptocurrency holdings, financial data, and linked payment methods, leading to direct asset theft or further targeted attacks against the victim's contacts or associated accounts. Technical evidence confirms the malicious nature of this domain. VirusTotal analysis shows 13 out of 95 security vendors flagging the domain as malicious, with detection labels including phishing, fraud, and social engineering. The domain was registered through Tucows Domains Inc and resolves to the IP address 216.150.16.193, hosted on infrastructure leveraging Node.js, React, and Google Cloud services. It appears on three independent security blocklists, and Google Safe Browsing explicitly categorizes it under SOCIAL_ENGINEERING. The SSL certificate is issued by Let's Encrypt, a common tactic used to lend false legitimacy to phishing sites. The page title, Uphold Login - Secure Access to Your Digital Wallet, directly impersonates the official Uphold brand, further corroborating the credential theft intent. Users who visited build-uphold.created.app or entered credentials on the site should take immediate action to mitigate risk. First, revoke access to any sessions or devices linked to the Uphold account and change the account password using the official Uphold website or application. Enable multi-factor authentication if not already active, using an authenticator app rather than SMS-based methods. Monitor the account for unauthorized transactions, linked devices, or changes to security settings. If financial assets were accessed or transferred, report the incident to the relevant financial institution and local cybercrime authorities. Additionally, scan the device used to access the site for malware or unauthorized applications, as credential theft sites may deploy secondary payloads to maintain persistence or capture additional sensitive data.