connect-uphold[.]created[.]app

This domain, connect-uphold.created.app, is identified as a high-risk generic phishing site targeting users of the Uphold digital asset platform. Analysis indicates the domain mimics the official Uphold login interface, presenting a page titled 'Uphold Login - Secure Access to Your Digital Assets,' designed to harvest user credentials and sensitive financial information. No direct evidence of a specific drainer kit was observed, but the infrastructure aligns with common phishing toolkits used for credential theft and account compromise. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain resolves to the IP address 216.150.16.1 and was registered through Tucows Domains Inc on May 21, 2026, a future date suggesting potential domain spoofing or incorrect registration data. Google Safe Browsing flags the domain under 'SOCIAL_ENGINEERING,' and it appears on three security blocklists. VirusTotal reports 15 out of 95 security vendors detecting the domain as malicious. The site employs technologies including Node.js, React, and Google Cloud, alongside a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. Currently, connect-uphold.created.app is offline, likely due to takedown actions or hosting suspension. The domain is blocked by multiple security providers, including MetaMask and PhishDestroy, and holds a Gridinsoft trust score of 0/100. Despite its offline status, residual risk remains for users who may have interacted with the domain prior to its deactivation. Organizations and individuals are advised to monitor for unauthorized access attempts, reset credentials for any accounts accessed via this domain, and implement multi-factor authentication to mitigate potential compromise. Continuous vigilance is recommended as similar domains may emerge using comparable infrastructure.