upholdloginn[.]created[.]app

This domain is flagged as an active credential theft site specifically targeting cryptocurrency and financial account holders. Analysis indicates the infrastructure is designed to harvest login credentials for Uphold, a platform managing crypto, stocks, and fiat currencies. The threat type is classified as crypto credential theft, a subset of phishing that aims to gain unauthorized access to digital asset wallets and financial accounts for subsequent fund extraction or identity fraud.

Infrastructure analysis reveals the domain upholdloginn.created.app resolves to the IP address 216.150.1.193, with no prior detections on VirusTotal (0/95 engines). The page title mimics the legitimate Uphold platform, displaying 'Uphold Login– Manage Crypto, Stocks & Money,' a clear indicator of brand impersonation. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to malicious sites. No blocklist entries or trust score downgrades were observed at the time of assessment, suggesting the campaign may still be in its early deployment phase or evading detection through low-volume targeting.

Mitigation steps for this specific threat type include immediate reporting to browser security teams, financial institutions, and domain registrars to initiate takedown procedures. Users who may have interacted with the domain should rotate credentials for all financial and crypto-related accounts, enable multi-factor authentication (MFA) where available, and monitor transaction histories for unauthorized activity. Organizations should update email and web filtering rules to block the domain and IP, and conduct internal awareness training to educate users on recognizing credential theft attempts targeting financial platforms. Indicators of compromise (IOCs) such as the domain, IP, and page title should be integrated into security monitoring tools for proactive detection.