net-uphold[.]created[.]app

PhishDestroy identifies net-uphold.created.app as an active brand impersonation domain masquerading as the legitimate cryptocurrency platform Uphold. The site uses a deceptive naming convention (created.app subdomain) to mimic Uphold’s branding and lure victims into credential theft or cryptocurrency draining. Analysts observed MetaMask browser extension blocking the domain, indicating active malicious intent in browser environments. No open-source drainer kit signatures were detected in initial scans, but the domain’s structure suggests integration with a credential harvesting or crypto drainer toolkit designed to siphon funds from unwitting users. This domain was flagged with a 5/95 VirusTotal detection score as of the latest scan, placing it below current antivirus coverage thresholds despite red flags from browser security extensions and blocklists. The domain resolves to IP 216.150.16.129 and utilizes a Let’s Encrypt SSL certificate to appear legitimate. It is served through Vercel’s app platform via the created.app domain namespace, a common tactic among threat actors to rapidly deploy malicious landing pages. Google Safe Browsing classifies the site under “SOCIAL_ENGINEERING,” confirming user deception tactics. The domain was detected on one active security blocklist and first observed during a recent sweep of crypto-related fraud infrastructure linked to seed 6c3c82. The domain remains active and unresolved as of this report, with MetaMask providing real-time protection for users. PhishDestroy recommends immediate blacklisting at the network and endpoint levels due to the combination of brand impersonation and low detection coverage. Users are advised to avoid interacting with any links referencing uphold within subdomain structures, validate URLs via official Uphold domains (uphold.com), and report such domains to security teams or browser vendors. The remaining risk is assessed as moderate due to active blocking by security tools but high potential for future exploitation if detection gaps persist.