sso-upheldlogin[.]created[.]app

The domain sso-upheldlogin.created.app was identified as a credential phishing resource targeting users of the Uphold digital asset platform. Analysis confirms the domain hosted a fraudulent login interface mimicking Uphold’s authentication portal, designed to harvest user credentials. The domain is currently offline, though prior activity was classified as high-risk due to its direct targeting of financial account access. Infrastructure analysis reveals the domain resolved to the IP address 216.150.1.129 and was registered through Tucows Domains Inc. Security vendor detections were substantial, with 15 of 95 vendors on VirusTotal flagging the domain as malicious. The domain appeared on three security blocklists, and its trust score was rated 0/100 by Gridinsoft. The site employed a Let’s Encrypt SSL certificate and utilized technologies including Node.js, React, and Google Cloud CDN, which are consistent with modern phishing frameworks. Google Safe Browsing classified the domain under the SOCIAL_ENGINEERING category, further corroborating its deceptive nature. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to monitor for unauthorized access to Uphold accounts, particularly if credentials were entered on the fraudulent site. Network-level blocking of the IP 216.150.1.129 and domain-based filtering of sso-upheldlogin.created.app are recommended to prevent re-exposure. Users should enable multi-factor authentication on all financial platforms and verify the legitimacy of login portals before entering sensitive information.