uphold-log-setup[.]created[.]app

This domain, uphold-log-setup.created.app, poses as a legitimate Uphold login portal to deceive users into entering account credentials. Analysis indicates it is a phishing site designed to harvest sensitive information, likely targeting cryptocurrency wallet access. The page title explicitly reads 'Change Uphold Login,' a tactic to manipulate users into believing they are updating their account details, while in reality, credentials are being captured for unauthorized access. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain resolves to the IP address 216.150.16.1 and was registered through Tucows Domains Inc. Security vendors on VirusTotal flagged the domain as malicious, with 18 out of 95 detections. Additionally, it appears on three security blocklists, and Google Safe Browsing classifies it under 'SOCIAL_ENGINEERING.' Technologies detected include Node.js, React, and Google Cloud, suggesting a sophisticated setup often used to evade initial scrutiny. If you visited uphold-log-setup.created.app or entered any credentials, immediate action is required. Disconnect the device from the internet to prevent potential data exfiltration. Change passwords for Uphold and any other accounts where the same credentials were used. Enable multi-factor authentication where available. Monitor financial and cryptocurrency accounts for unauthorized transactions. Report the incident to relevant security teams and consider scanning the device for malware to ensure no additional compromise has occurred.