log-iouphld[.]created[.]app

Analysis of log-iouphld.created.app shows a domain created on 12 July 2023 through Tucows Domains Inc. The site resolves to IP address 216.150.16.193, which belongs to Amazon.com, Inc. (AS16509) and is located in the United States. DNS resolution is handled by Vercel name servers ns1.vercel-dns.com and ns2.vercel-dns.com, and the underlying infrastructure includes Google Cloud, Vercel, LaunchDarkly, HTTP Strict Transport Security (HSTS), and Google Cloud CDN. The presence of a Let’s Encrypt R13 certificate indicates the domain was served over HTTPS, yet an HTTP 404 status was returned when the page was accessed, suggesting that the malicious content has been removed or was never publicly reachable at the time of testing.

The page title reported by the server – "Uphold Login - Secure Access to Your Digital Wallet | Official Guide" – directly references the Uphold brand, confirming the intentional brand impersonation. The domain is classified as a crypto‑related scam and has been flagged by six of ninety‑five VirusTotal scanners, demonstrating moderate detection across reputation engines. It appears on a single external security blocklist and is recorded as blocked by PhishDestroy.

The current offline status prevents any direct observation of the phishing page layout or credential‑harvesting mechanisms, leaving the exact visual tactics uncertain. Defenders should maintain blocking of the domain at DNS and web‑gateway controls, monitor the associated IP address and Vercel name servers for any re‑use, and treat any future resolution of log-iouphld.created.app as malicious. Given the concrete evidence of brand targeting, SSL provisioning, and detection signals, the domain should be treated as a high‑confidence impersonation of Uphold used for cryptocurrency credential theft.