new-uphold[.]created[.]app

This domain, new-uphold.created.app, was registered on May 21 2026 through Tucows Domains Inc and began serving content shortly thereafter. Google Safe Browsing classifies it under the SOCIAL_ENGINEERING category, and Gridinsoft assigns a trust score of 0 out of 100, indicating extreme suspicion. The site returns HTTP 200 and presents the page title “Login® – Uphold* – Trade Digital Assets,” a clear attempt to imitate a legitimate financial service.

The hosting infrastructure resolves to IP 216.150.16.1, which maps to a Vercel, Inc. location in the United States. DNS resolution uses Vercel’s authoritative nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com). The web stack is identified as Node.js and React running on Next.js, with Google Cloud CDN and HSTS enabled, and feature flags managed by LaunchDarkly. TLS is provided by a Let’s Encrypt certificate (R13), confirming the use of a valid, automated certificate.

Threat intelligence flags the domain on three independent blocklists, and it is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal records 17 detections out of 95 scanned security vendors, reinforcing the malicious classification. The combination of a credential‑phishing lure, the exact page title, and the high‑risk rating from multiple sources aligns with a credential‑phishing campaign targeting users of the genuine service.

Analysis confirms the presence of the phishing infrastructure but cannot yet reveal the full command‑and‑control topology or any additional payloads beyond the credential capture page. Defenders should block the domain at network perimeter, enforce strict TLS inspection, and monitor DNS queries for the Vercel nameservers. End users must be warned to avoid entering credentials on any site presenting the “Uphold” login interface that is hosted on new-uphold.created.app, and compromised credentials should be reset immediately.