uphould-logun[.]created[.]app

This domain, uphould-logun.created.app, operates as a fraudulent cryptocurrency wallet login portal designed to harvest credentials and private keys from unsuspecting users. Analysis of the page title, 'Uphold Login: Secure Access to Your Official Wallet,' confirms the site impersonates the legitimate Uphold platform, a known digital asset wallet provider. The infrastructure is engineered to deceive users into entering sensitive authentication details, which are then exfiltrated to attacker-controlled servers for immediate exploitation, likely leading to unauthorized fund transfers or account takeovers. The threat specifically targets cryptocurrency holders, exploiting trust in the Uphold brand to facilitate financial theft through credential compromise and potential crypto draining techniques. Evidence supporting the malicious classification includes multiple technical indicators. The domain was registered on May 21, 2026, through Tucows Domains Inc, with an unusually recent creation date that aligns with common phishing lifecycle patterns. Security vendors on VirusTotal flagged the domain at a rate of 17 out of 95, indicating broad detection across multiple threat intelligence sources. The site appears on three independent security blocklists and is actively blocked by cryptocurrency security tools and browser extensions. Infrastructure analysis reveals the domain resolves to IP address 216.150.1.1 and employs Let's Encrypt SSL certificates, a common tactic to mimic legitimacy while avoiding the scrutiny associated with paid certificates. Google Safe Browsing has explicitly tagged the domain with a 'SOCIAL_ENGINEERING' classification, further validating its deceptive nature. Users who visited uphould-logun.created.app should assume their credentials or private keys have been compromised. Immediate action is required: revoke any active sessions on legitimate Uphold accounts, change passwords using a secure device, and enable multi-factor authentication if not already active. Monitor all linked accounts for unauthorized transactions and report any suspicious activity to the legitimate platform's support team. Cryptocurrency users should also check wallet addresses for unexpected changes and consider transferring assets to a new wallet if any interaction with the phishing site occurred. The domain has been taken offline, but users should remain vigilant for follow-up phishing attempts via email or other communication channels that may reference this incident.