join-uphold[.]created[.]app

The domain join-uphold.created.app was identified as a high-risk phishing infrastructure designed to impersonate Google through a fraudulent Uphold login interface. Analysis confirms this as a brand impersonation attack, targeting users with a fabricated authentication portal to harvest credentials and session tokens. The domain is currently offline, though prior activity indicates a deliberate attempt to deceive users into disclosing sensitive account information. Infrastructure analysis reveals the domain was flagged by 12 of 95 security vendors on VirusTotal, with Google Safe Browsing categorizing it under SOCIAL_ENGINEERING. It appears on three security blocklists and is blocked by multiple detection systems. The domain resolves to the IP address 216.150.1.1 and was registered through Tucows Domains Inc. The SSL certificate is issued by Let’s Encrypt, a common choice for malicious actors due to its accessibility. Technologies detected include Node.js, React, Next.js, and Google Cloud CDN, suggesting the use of modern web frameworks to enhance the legitimacy of the phishing page. The page title, 'Uphold Login* - Getting Started with Login,' further supports the impersonation of a legitimate authentication portal. Current status indicates the domain has been taken offline, though the underlying infrastructure may remain dormant for future reuse. Organizations and users are advised to treat any prior interaction with this domain as compromised and initiate password resets for associated accounts. Network-level blocking of the IP address 216.150.1.1 is recommended to prevent potential redirects or residual threats. Security teams should monitor for similar domains leveraging Google Cloud or Vercel hosting, as these platforms are frequently abused for phishing campaigns. End-users should verify the authenticity of login pages by cross-referencing URLs with official sources and enabling multi-factor authentication to mitigate credential theft risks.