en-uphold-login[.]created[.]app

This domain, en-uphold-login.created.app, was engineered to conduct credential phishing targeting users of the Uphold digital asset platform. The site mimicked Uphold’s login interface to harvest cryptocurrency account credentials, including usernames, passwords, and potentially multi-factor authentication codes. Infrastructure analysis reveals the domain was designed to exploit trust in Uphold’s branding, likely distributing stolen credentials to unauthorized third parties for financial theft or account takeover attacks on cryptocurrency wallets and exchanges. Evidence confirms the domain’s malicious intent through multiple technical indicators. The domain was flagged by 14 out of 95 security vendors on VirusTotal, with Google Safe Browsing categorizing it under SOCIAL_ENGINEERING. Registered through Tucows Domains Inc on May 21, 2026, the domain resolved to the IP address 216.150.16.193 and employed a Let’s Encrypt SSL certificate to feign legitimacy. It appeared on three security blocklists and was actively blocked by MetaMask, PhishDestroy, and SEAL. Detected technologies included Node.js, React, Google Cloud, Vercel, and Next.js, suggesting a modern, cloud-based phishing infrastructure. Users who visited en-uphold-login.created.app should assume their credentials were compromised. Immediate actions include resetting passwords for Uphold and any other accounts where the same credentials were reused. Enable multi-factor authentication on all financial and cryptocurrency platforms if not already active. Monitor accounts for unauthorized transactions and report suspicious activity to the affected platform’s security team. If financial loss occurred, contact local law enforcement or relevant cybercrime reporting authorities. Review browser and device security to ensure no residual malware or unauthorized access persists.