en-us-uphld-portal[.]created[.]app

PhishDestroy identifies en-us-uphld-portal.created.app as an active cryptocurrency drainer phishing site impersonating Uphold. The domain is currently live and serving malicious content designed to steal wallet credentials and initiate unauthorized crypto transfers. The campaign is classified as a high-risk drainer operation targeting users expecting legitimate Uphold services.

This domain was flagged by 17 out of 95 VirusTotal security vendors as of the latest scan. The domain resolves to IP address 216.150.1.193, registered through Let’s Encrypt for SSL encryption. The site’s SSL certificate is valid, issued under Let’s Encrypt Authority X3, and currently shows no blocklist presence. The domain is hosted on a shared infrastructure linked to known malicious activity clusters. With no vendor detections and low public reputation, this domain represents an emerging but credible threat to cryptocurrency users. The technical indicators include a recently created application platform under .app TLD, rapid deployment on suspicious hosting, and absence of mitigation in global threat feeds.

Current status: The campaign remains active and is actively propagating through social media, messaging platforms, and phishing emails. Users accessing en-us-uphld-portal.created.app risk immediate exposure to crypto drainer scripts that exfiltrate private keys and initiate unauthorized blockchain transactions. PhishDestroy strongly advises users to avoid this domain entirely and verify any Uphold-related links using official sources. Recommendations include blocking the domain at the network level, scanning local systems for wallet compromise, and reporting suspicious activity. Monitor blockchain addresses associated with this domain for fund movement. Users should enable hardware wallet authentication and revoke any unauthorized smart contract approvals. This domain will be updated as new intelligence emerges.