uphld-en-us[.]created[.]app

The domain uphld-en-us.created.app is currently offline but exhibits multiple indicators of a high‑risk phishing operation targeting users of a digital‑asset trading platform. The site served a page titled "Uphold Login - Secure Digital Asset Trading Platform | Invest in 200+ Assets," directly impersonating the legitimate Uphold service, and the SSL certificate presented is from Let’s Encrypt (R13), a common choice for malicious actors due to its free issuance and rapid renewal. Infrastructure analysis shows the domain resolves to IP 216.150.1.129, hosted within Amazon’s AS16509 network in the United States, and uses Vercel DNS nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com). The HTTP response is a 404 status, indicating the content has been removed or the host is no longer serving the page, consistent with the reported offline status.

Reputation checks reveal a Gridinsoft trust score of 0 / 100, Google Safe Browsing flags for social engineering, and five of ninety‑one VirusTotal scanners have flagged the domain as malicious. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a fake exchange phishing site. Registration details list Name.com, Inc. as the registrar, but no further registration metadata is available.

While the site is no longer reachable, the observed indicators suggest a previously active credential‑harvesting campaign. Defenders should continue to block the domain at network perimeters, update URL filtering and threat intelligence feeds with the IP address 216.150.1.129, and monitor for any re‑use of the associated infrastructure. Analysts should also audit logs for any attempted connections to this domain or its IP, and enforce multi‑factor authentication for accounts related to the Uphold brand to mitigate potential credential compromise.