ai-uphold[.]created[.]app

The domain ai-uphold.created.app has been identified as a high-risk phishing portal specifically designed to impersonate the official Uphold cryptocurrency platform. Analysis confirms this as a brand impersonation attack, presenting a fraudulent login interface under the page title 'Official Site® | Uphold Login® | Getting started — Uphold®.' The domain is currently offline, though prior activity indicates it was actively targeting users seeking to access Uphold accounts for credential harvesting or cryptocurrency theft. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc and resolved to the IP address 216.150.16.65. Security vendor detections on VirusTotal indicate that 15 of 95 engines flagged this domain as malicious, while it appears on three independent security blocklists. The site employed a Let's Encrypt SSL certificate, which, while providing basic encryption, does not validate legitimacy. Additional technical indicators include the use of Node.js, React, Google Cloud, Vercel, and Next.js—common frameworks that may have been leveraged to create a convincing replica of the legitimate Uphold interface. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. At present, ai-uphold.created.app has been taken offline, though similar domains may emerge using comparable tactics. Users who accessed this domain should immediately revoke any active sessions, reset credentials for Uphold and associated financial accounts, and monitor for unauthorized transactions. Organizations are advised to update blocklists with the domain and IP address, while security teams should investigate potential exposure through logs or proxy data. Proactive measures, including multi-factor authentication and browser-based phishing protections, are recommended to mitigate future risks from brand impersonation attacks.