up-hold-log-in[.]created[.]app

This domain is flagged as a high-risk fake login portal specifically targeting Uphold users. Analysis indicates the site impersonates the legitimate Uphold cryptocurrency and digital asset platform, presenting a fraudulent login interface to harvest credentials and potentially facilitate unauthorized access to user accounts. The threat type is classified as brand impersonation with credential theft objectives, commonly used to execute subsequent crypto asset theft or account takeover attacks. Infrastructure analysis reveals the domain up-hold-log-in.created.app was registered through Tucows Domains Inc and resolved to IP address 216.150.1.193. The site was detected by 15 out of 95 security vendors on VirusTotal, with Google Safe Browsing categorizing it under SOCIAL_ENGINEERING. The domain appeared on three security blocklists and was actively blocked by multiple security mechanisms. Detected technologies include Node.js, React, Google Cloud, Vercel, Next.js, and LaunchDarkly, with a Let's Encrypt SSL certificate. Gridinsoft assigned a trust score of 0/100, and the page title mimicked the legitimate Uphold branding with "Uphold Login - Secure Access to Your Digital Assets | Crypto, Stocks." Mitigation requires immediate credential rotation for any users who accessed the site. Organizations should add the domain and associated IP to blocklists, monitor for credential reuse attempts, and implement multi-factor authentication for all digital asset accounts. Security teams should analyze logs for connections to 216.150.1.193 and review authentication attempts from the timeframe the site was active. User education should emphasize verifying domain authenticity before entering credentials, particularly for financial and crypto platforms. The offline status does not eliminate risk, as harvested credentials may still be exploited.