sso-up-hold-io[.]created[.]app

This domain operates as a credential harvesting phishing site targeting users of the legitimate Uphold financial platform. The page mimics the official Uphold login interface, presenting a fraudulent form titled 'Log In | Uphold : | Sign In to Your Account' to deceive visitors into submitting sensitive login credentials. Analysis indicates the site is designed to capture and exfiltrate user input, likely for subsequent unauthorized account access or financial fraud. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on June 13, 2026, through Name.com, Inc., and resolves to the IP address 216.150.1.1. Security vendors have flagged the domain, with 13 out of 95 engines on VirusTotal detecting it as malicious. The site appears on three security blocklists and is actively blocked by multiple threat intelligence feeds. Detected technologies include Node.js, React, and Google Cloud infrastructure, suggesting a sophisticated deployment. Users who visited this domain should immediately revoke any entered credentials and enable multi-factor authentication on their legitimate Uphold accounts. Monitor financial statements for unauthorized transactions and consider resetting passwords for any accounts where similar credentials may have been reused. The domain has since been taken offline; however, users should remain vigilant for similar phishing attempts using newly registered domains or slight variations of legitimate service names.