uphold-log-us[.]created[.]app

This domain, uphold-log-us.created.app, is a high-risk phishing site designed to impersonate the Uphold cryptocurrency platform's login and two-factor authentication (2FA) page. The page title, 'Uphold Login & 2FA: Security Update,' explicitly targets users by falsely presenting itself as an official security measure. Analysis indicates the domain aims to harvest login credentials and 2FA codes, enabling unauthorized access to victim accounts and potential financial theft. The fraudulent nature of the site is further evidenced by its use of social engineering tactics, as confirmed by its classification under 'SOCIAL_ENGINEERING' in Google Safe Browsing. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain is flagged by 12 out of 95 security vendors on VirusTotal, demonstrating broad detection across the security community. It is registered through Name.com, Inc., and resolves to the IP address 216.150.1.65. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds. Technologies detected on the site include Node.js, React, and Google Cloud, suggesting a sophisticated infrastructure commonly used in phishing campaigns to evade detection and scale operations. Users who visited uphold-log-us.created.app should immediately revoke any entered credentials and enable multi-factor authentication on their legitimate Uphold account. It is recommended to scan the device used to access the site for malware, as phishing pages may deploy additional payloads. Monitor financial accounts for unauthorized transactions and report the incident to the platform's official support channels. If 2FA codes were submitted, consider regenerating backup codes and reviewing recent login activity for signs of compromise.