login-uphold-web-io[.]created[.]app

Analysis of login-uphold-web-io.created.app indicates a credential‑phishing operation targeting users of the Uphold financial platform. The domain is registered through Name.com, Inc. and resolves to IP 216.150.16.1, an address owned by Amazon.com, Inc. (AS16509) located in the United States. DNS resolution is delegated to ns1.vercel-dns.com and ns2.vercel-dns.com, suggesting the use of Vercel’s DNS infrastructure. The site presented a page title of “Uphold Login – Access Your Multi‑Asset Financial Account,” confirming the intended brand impersonation, but the HTTP response returned a 404 status, and the domain is currently taken offline.

Security telemetry shows the domain appears on three independent blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans reported nine of ninety‑one security vendors flagging the domain as malicious, reinforcing the phishing assessment. The SSL certificate is issued by Let’s Encrypt (R13), providing a valid TLS handshake but offering no assurance of legitimacy.

While the offline state limits immediate threat exposure, the infrastructure—especially the Amazon‑hosted IP and Vercel DNS—could be reused for future campaigns. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP for any re‑activation, and consider adding the IP to reputation feeds. Ongoing observation of the registrar and nameserver configurations is advised to detect any rapid re‑registration or redeployment attempts.