learn-uphold[.]created[.]app

This domain, learn-uphold.created.app, operates as a credential harvesting phishing site targeting users of a cryptocurrency platform. The page mimics the legitimate login interface, presenting a fraudulent sign-in form designed to capture usernames, passwords, and potentially multi-factor authentication codes. Analysis indicates the site was constructed to deceive visitors into disclosing sensitive account credentials, which could lead to unauthorized access, financial theft, or further exploitation through compromised accounts. The use of a cloned login page, combined with a domain name incorporating a trusted brand, increases the likelihood of successful deception, particularly among users unfamiliar with phishing tactics. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc and resolves to the IP address 216.150.16.1. The site employs a Let's Encrypt SSL certificate, creating a false sense of security for visitors. Detection metrics indicate broad recognition of the threat: 11 out of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on three distinct security blocklists. The page title, 'Uphold LogIn ®: | Sign In to Your Account,' directly mirrors the branding of the legitimate platform, further corroborating its intent to impersonate. Technologies detected include Node.js, React, and Google Cloud, suggesting the use of modern web frameworks to facilitate the phishing operation. Users who visited this domain should take immediate action to mitigate potential risks. First, change the password for the targeted account and any other platforms where the same credentials may have been reused. Enable multi-factor authentication if not already active, using an authenticator application rather than SMS-based verification. Monitor the account for unauthorized transactions or suspicious activity, and review connected devices or sessions for signs of compromise. If financial information was entered, contact the relevant institution to report potential fraud. Finally, scan local devices for malware, as phishing sites may redirect to exploit kits or serve additional payloads. Awareness of this domain’s tactics can help prevent future incidents, particularly when encountering unsolicited login prompts or domains with unusual structures.