uphld-eng[.]created[.]app

Analysis of uphld-eng.created.app indicates a high‑risk credential‑phishing campaign targeting users of the Uphold digital‑money platform. The domain was registered on 21 February 2026 through Tucows Domains Inc. and resolves to the IP address 216.150.16.1, which belongs to Amazon.com, Inc. (AS16509) in the United States. DNS resolution is handled by ns1.vercel-dns.com and ns2.vercel-dns.com, consistent with the Vercel hosting environment detected in the infrastructure fingerprint. The server presents a Let’s Encrypt R13 certificate, and HTTP requests return a 404 status, suggesting the site is currently taken offline but was previously serving content that included the page title “Uphold Login – Secure Digital Money Platform”.

This title directly references the targeted brand, confirming the impersonation intent. Threat‑intelligence feeds flag the domain on three independent blocklists, including PhishDestroy, MetaMask, and SEAL, and VirusTotal reports that ten of ninety‑three scanning engines have identified it as malicious. The presence of Google Cloud, Vercel, HSTS, and Google Cloud CDN in the technology stack indicates the attacker leveraged widely trusted cloud services to host the phishing page, potentially increasing its credibility among victims. While the offline status prevents real‑time observation of the payload, the combination of a brand‑specific page title, confirmed blocklist listings, and multiple vendor detections provides sufficient evidence of a credential‑phishing operation.

Defenders should continue to block the domain at network perimeters, update URL filtering policies, and monitor for any resurgence of activity from the associated IP address or Vercel name‑servers. Security teams should also advise users of Uphold to verify URLs carefully and to report any unexpected login prompts. Ongoing collection of DNS and TLS telemetry is recommended to detect possible re‑hosting attempts using the same infrastructure.