uphold-loginn[.]created[.]app
“Uphold Login | Secure Access to Your Crypto and Financial Account”
Stored detection
Cloaking alert
- Cloaking type
content_split- Cloaking score
- 1/6
Evidence Summary
The domain uphold-loginn.created.app was registered on May 21 2026 through Tucows Domains Inc and resolves to IP 216.150.16.65, a server hosted by Vercel, Inc in the United States. The site presents a valid TLS certificate issued by Let’s Encrypt (R13) and returns HTTP 200 for the root URL. The observed page title, "Uphold Login | Secure Access to Your Crypto and Financial Account," aligns with the credential phishing classification. A security rating assigns a trust score of 0/100, and five of ninety‑one security scanners have flagged the domain. It is listed on three public blocklists and is blocked by PhishDestroy and SEAL. Nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com. Infrastructure analysis indicates a recent deployment on Vercel’s shared hosting environment, a pattern frequently used for short‑lived phishing sites. The evidence confirms active credential harvesting targeting users of the referenced financial service. The exact data capture mechanisms and any downstream exfiltration endpoints have not been examined, leaving those details uncertain. Defenders should add the domain and its IP address to deny‑list rules, monitor DNS queries for the associated Vercel nameservers, enforce multi‑factor authentication for potentially targeted accounts, and schedule periodic rescans to capture any changes in detection status or hosting configuration.
Data Coverage
Threat Response Pipeline
Blocklist coverage
10 monitored external feeds · stored snapshot Aug 10, 2026
8 monitored external feeds No match
Domain Intelligence
Technical detailsDNS, TLS names and timestamps
ICANN OVERSIGHT
Registration: created.app
Accreditation and RAA context
Accreditation and RAA context
Registrar accreditation and DNS abuse obligations
For the registrable domain created.app behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
VirusTotal Analysis
Were You Affected by This Site?
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
Check Any Domain
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowReport Phishing
Submit suspicious domains to our threat database — protect the community
ReportLive Threat Feed
Recent phishing reports and observed availability changes
MonitorStay Informed, Stay Safe
Monitor live threats or contest this listing if you believe it's a false positive