en-upholdcom[.]created[.]app

This domain, en-upholdcom.created.app, is currently under investigation for credential theft targeting Uphold, a cryptocurrency exchange platform. The threat specifically involves brand impersonation, presenting a fraudulent interface designed to harvest login credentials and sensitive financial information from users attempting to access Uphold services. As of the latest assessment, the domain remains active and has not been flagged by security vendors. Infrastructure analysis reveals the domain resolves to the IP address 216.150.16.65 and uses a Let's Encrypt SSL certificate, which is common among both legitimate and malicious sites. The page title, 'Uphold: Buy & Sell Crypto, Stablecoins and more,' directly mimics the official Uphold branding to enhance credibility. VirusTotal reports 0 detections out of 95 vendors, indicating the domain has not yet been widely flagged by security engines. The registrar for this domain is associated with the 'created.app' subdomain service, which has been previously observed in phishing campaigns due to its low barrier for domain creation and anonymity features. No additional blocklist entries or trust scores were identified at the time of analysis. The current risk assessment indicates a moderate to high threat level due to the targeted nature of the credential theft and the active status of the domain. Users are advised to verify the legitimacy of any Uphold-related communications by directly accessing the official website via a known, trusted URL. Organizations should consider implementing DNS-based blocking for en-upholdcom.created.app and its associated IP address, 216.150.16.65, to prevent potential exposure. Security teams are encouraged to monitor for any interactions with this domain within their networks and conduct retrospective analysis for signs of compromise. Additional scrutiny of domains using the 'created.app' subdomain structure is recommended due to its recurring use in phishing operations.