uphlldlogn[.]created[.]app

The domain uphlldlogn.created.app is actively impersonating the financial service Uphold to conduct credential phishing attacks. It is flagged as malicious by 1 out of 91 VirusTotal vendors and is listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL. The site is hosted on an IP address associated with Amazon.com, Inc., located in the United States, and uses an SSL certificate issued by Let's Encrypt.

Despite its low cloaking score of 1 out of 10, indicating it serves benign content to scanners, the domain's phishing intent is clear from its page title, "Uphold® Login | Sign In to Your Wallet & Assets." This suggests that attackers are attempting to harvest login credentials by mimicking the legitimate Uphold login page. The domain's registration details are obscured, with the registrar listed as REGISTRAR_NOT_FOUND, which is a common tactic used by threat actors to avoid detection.

PhishDestroy identified this domain on June 22, 2026, highlighting its ability to detect threats in the critical early window before widespread recognition by antivirus vendors. The presence of this domain on multiple blocklists underscores the importance of proactive threat detection and the challenges posed by phishing sites that exploit the delay in antivirus database updates. Users are encouraged to remain aware of such threats and verify the legitimacy of financial service websites before entering sensitive information.