uphald-app-ai[.]created[.]app

The domain uphald-app-ai.created.app has been identified as a high-risk credential theft operation impersonating the Uphold cryptocurrency trading platform. Analysis of the page title, Uphold Login® | Enter Your Trading Dashboard™, confirms the intent to deceive users into submitting authentication credentials. The domain is currently offline, though prior activity suggests a targeted campaign against Uphold account holders. Infrastructure analysis reveals the domain was registered through Name.com, Inc. and resolves to the IP address 216.150.1.1. Detection metrics indicate 8 of 95 security vendors on VirusTotal flagged the domain, while three distinct blocklists—including MetaMask, PhishDestroy, and SEAL—have classified it as malicious. The site employed modern web technologies, including Node.js, React, and Next.js, alongside Google Cloud infrastructure and a Let’s Encrypt SSL certificate, likely to enhance perceived legitimacy. Google Safe Browsing further categorized the domain under SOCIAL_ENGINEERING, reinforcing its fraudulent nature. Current status confirms the domain has been taken offline, though similar campaigns may reemerge using comparable infrastructure. Organizations and end-users are advised to implement strict domain validation protocols, particularly for financial and cryptocurrency platforms. Monitoring for newly registered domains with similar naming patterns (e.g., brand impersonation via subdomains) and enforcing multi-factor authentication can mitigate credential theft risks. Security teams should prioritize blocking the identified IP and domains associated with this campaign in network defenses.