up-hold-io[.]created[.]app

The domain up-hold-io.created.app was registered on May 21, 2026 through Tucows Domains Inc and is currently resolved to the IPv4 address 216.150.16.129. The host resolves to a Vercel, Inc. infrastructure located in the United States and serves content over HTTPS using a Let’s Encrypt R13 certificate. Both authoritative name servers are ns1.vercel-dns.com and ns2.vercel-dns.com, matching the Vercel hosting profile.

Web requests to the site return HTTP 200 responses and the page title is “Getting Started with Uphold Login”, which aligns with credential‑harvesting templates that mimic legitimate financial service logins. The site is listed on three public security blocklists and receives a Gridinsoft trust rating of 0 out of 100, indicating a high confidence of malicious intent.

Multiple detection engines have flagged the domain. VirusTotal reports three detections out of ninety‑five scanners, and Google Safe Browsing classifies the URL under the SOCIAL_ENGINEERING category. Additionally, the domain is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the view that it is used for phishing campaigns targeting users of the Uphold platform.

Analysis confirms the domain as a high‑risk phishing vector. While the exact credential collection backend has not been disclosed, the consistent use of a legitimate‑looking login page and the observed blocking by multiple anti‑phishing services suggest an active campaign. Defenders should add the domain to network deny lists, enforce DNS filtering, and monitor outbound connections to the 216.150.16.129 address. Endpoint security policies should block any form submissions to the “Getting Started with Uphold Login” page, and users should be warned that legitimate Uphold authentication never occurs on a created.app sub‑domain.