support-uphold-cdn[.]created[.]app

This domain, support-uphold-cdn.created.app, operates as a brand impersonation scam targeting users of the Uphold digital money platform. Analysis of the page title, 'Log In | Uphold™,' confirms the domain mimics the legitimate Uphold login interface to harvest credentials. The threat specifically involves a fake login portal designed to deceive users into entering sensitive account information, which attackers can then exploit for unauthorized access or financial theft. Given the high-risk nature of credential harvesting, this infrastructure poses a direct threat to individuals and organizations using Uphold services. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain resolves to the IP address 216.150.1.65 and is currently flagged by 14 out of 95 security vendors on VirusTotal. It appears on three security blocklists and is registered through Tucows Domains Inc. Google Safe Browsing has classified the domain as phishing, and the SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites. The domain was taken offline, but its prior activity and detection metrics underscore its fraudulent intent. Users who visited this domain or entered credentials on the fake login page should take immediate action to mitigate risk. First, reset passwords for Uphold and any other accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor financial transactions and account activity for signs of compromise, such as unauthorized logins or transfers. If financial loss is suspected, report the incident to relevant authorities and financial institutions. Additionally, scan local devices for malware, as phishing sites may deploy additional payloads to maintain persistence or exfiltrate data.