uphold-log-faq[.]created[.]app

This domain is currently under investigation for credential phishing activity specifically impersonating Uphold, a digital finance platform. Analysis indicates a targeted attempt to harvest login credentials or sensitive financial information from users by mimicking legitimate support or transactional pages. Infrastructure analysis reveals the domain uphold-log-faq.created.app resolves to IP address 216.150.16.1 and is hosted with a Let's Encrypt SSL certificate, providing a false sense of security. VirusTotal reports zero detections out of 95 engines, suggesting the threat is either new or employs evasion techniques. The domain was recently taken offline, though its creation date and registrar details remain under review. No blocklist entries or trust score anomalies have been identified at this time, though the lack of prior detections does not preclude malicious intent. Mitigation steps for this specific threat type include immediate revocation of any credentials potentially exposed to the domain, particularly for users who interacted with pages under uphold-log-faq.created.app. Network administrators should block the IP 216.150.16.1 and monitor for related subdomains or newly registered lookalike domains. Users are advised to verify all communication from Uphold through official channels and enable multi-factor authentication to mitigate credential theft risks. Organizations should also review logs for connections to the domain or IP to assess potential compromise.