uphold-lgagin[.]created[.]app

The domain uphold-lgagin.created.app is identified as a cryptocurrency phishing site designed to harvest wallet credentials through social engineering. Currently, this domain is offline, but prior activity indicates it impersonated legitimate cryptocurrency platforms to deceive users into disclosing sensitive information. Analysis confirms its malicious intent and high-risk classification. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc on May 21, 2026, and resolved to the IP address 216.150.1.65. It is flagged by 15 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on three security blocklists and is explicitly blocked by multiple threat intelligence feeds, including MetaMask and SEAL. Google Safe Browsing categorizes it under SOCIAL_ENGINEERING, while its SSL certificate is issued by Let’s Encrypt, a common tactic to lend superficial legitimacy to phishing infrastructure. Although uphold-lgagin.created.app is currently offline, its prior operational state and technical indicators confirm malicious intent. Organizations and users are advised to maintain blocklist updates, monitor for related domains with similar naming patterns, and implement strict access controls for cryptocurrency transactions. Network administrators should ensure endpoint protection systems are configured to detect and prevent connections to known phishing infrastructure, particularly those mimicking financial or wallet services.