eng-uphold[.]created[.]app

This domain, eng-uphold.created.app, is identified as a high-risk credential phishing site specifically designed to impersonate the Uphold digital money platform. The threat type is classified as generic phishing with a focus on social engineering to harvest user login credentials. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for retrospective analysis and potential re-emergence. Analysis indicates the domain was flagged by 14 of 95 security vendors on VirusTotal, with Google Safe Browsing specifically categorizing it under SOCIAL_ENGINEERING. The domain appears on three security blocklists and is blocked by multiple endpoint protection systems. It was registered through Tucows Domains Inc and resolves to the IP address 216.150.16.1. The SSL certificate is issued by Let’s Encrypt, a common choice among threat actors due to its accessibility and lack of cost. Infrastructure analysis reveals the use of modern web technologies including Node.js, React, Next.js, and Google Cloud CDN, suggesting an attempt to mimic legitimate service architecture. The Gridinsoft trust score for this domain is 0 out of 100, reinforcing its malicious classification. The domain is currently offline, reducing immediate risk to end users. However, organizations and individuals should remain vigilant for potential re-registration or re-deployment under a different domain. It is recommended to implement DNS-based blocking for this domain and its associated IP address 216.150.16.1 within enterprise security controls. Users who may have interacted with the site should be advised to reset credentials for Uphold and any other services where identical login information was used. Security teams should monitor for indicators of compromise, including unusual login attempts or unauthorized transactions linked to Uphold accounts. Proactive threat hunting for related infrastructure, such as domains registered through the same registrar or resolving to the same IP range, is advised to identify potential campaign expansion.