home-uphold-web[.]created[.]app

The domain home-uphold-web.created.app is identified as a phishing infrastructure specifically designed to impersonate the Uphold cryptocurrency platform. Analysis confirms this as a credential harvesting operation, with the page title explicitly mimicking Uphold's official branding: 'Official Site® | Uphold Login® | Getting started — Uphold®'. The domain is currently offline, though prior activity indicates it was actively used to deceive users into submitting login credentials under false pretenses.

Technical indicators reveal multiple red flags associated with this domain. It is flagged by 14 of 95 security vendors on VirusTotal, including leading threat intelligence providers. The domain resolves to the IP address 216.150.16.193 and is registered through Tucows Domains Inc. It appears on three independent security blocklists, and Google Safe Browsing has classified it as phishing. The SSL certificate is issued by Let's Encrypt (R13), a common tactic among threat actors to lend superficial legitimacy to fraudulent sites. No legitimate creation date or historical WHOIS data was provided, suggesting efforts to obscure ownership and timing of deployment.

Given the domain's current offline status, immediate user risk is reduced; however, the infrastructure may resurface under a different domain or IP. Users who accessed this site should assume credential compromise and take immediate action: reset passwords for Uphold and any accounts sharing the same credentials, enable multi-factor authentication where available, and monitor financial transactions for unauthorized activity. Organizations should block the domain and associated IP at the network level, update endpoint protection rules, and conduct internal awareness training to recognize similar phishing attempts targeting financial platforms.