log-upheld[.]created[.]app

This domain, log-upheld.created.app, poses a significant credential harvesting threat targeting users of a legitimate digital asset platform. The site presents a fraudulent login page titled 'Log In | Uphold — Buy,' designed to deceive visitors into entering sensitive account credentials, which are then captured by threat actors. Such phishing infrastructure is commonly used to facilitate unauthorized access to financial accounts, cryptocurrency wallets, or other high-value platforms, leading to potential asset theft or identity fraud. Analysis indicates this domain was registered through Tucows Domains Inc and is flagged by 15 out of 95 security vendors on VirusTotal, including MetaMask, PhishDestroy, and SEAL blocklists. The site resolves to the IP address 216.150.16.193 and employs a Let's Encrypt SSL certificate, a common tactic to appear legitimate. Additional infrastructure details reveal the use of Node.js, React, Google Cloud, Vercel, and Next.js technologies, which are frequently leveraged in both legitimate and malicious web applications. The presence of HSTS and Google Cloud CDN further complicates detection, as these features are typically associated with secure, enterprise-grade services. If a user has visited log-upheld.created.app or entered credentials on this site, immediate action is required. First, revoke access to any accounts that may have been compromised, particularly those linked to financial or cryptocurrency services. Change passwords for all associated accounts, enabling multi-factor authentication where available. Monitor accounts for unauthorized transactions or suspicious activity, and report the incident to relevant security teams or fraud prevention services. Users should also scan their devices for malware, as phishing sites may distribute additional payloads. Finally, verify the legitimacy of any communications claiming to be from the targeted platform to avoid further exploitation.