uphold-loginese[.]created[.]app

This domain, uphold-loginese.created.app, operates as a high-risk credential phishing infrastructure designed to impersonate the Uphold digital asset platform. Analysis indicates the site presents a fraudulent login interface under the guise of a "Secure & Smooth Access: Uphold Login Guide," aiming to harvest user credentials for unauthorized account access. No direct evidence of a crypto drainer kit was observed, but the credential harvesting mechanism aligns with common precursors to asset theft in digital finance fraud schemes. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 14 out of 95 security vendors on VirusTotal, with Google Safe Browsing categorizing it under "SOCIAL_ENGINEERING." It is registered through Name.com, Inc. and resolves to the IP address 216.150.1.65. The site appears on three security blocklists, including MetaMask and PhishDestroy, and employs technologies such as Node.js, React, Google Cloud, Vercel, and Next.js. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. The domain was detected using HSTS and Google Cloud CDN, which may have been leveraged to enhance perceived legitimacy. As of the latest assessment, the domain has been taken offline, reducing immediate exposure risk. However, the infrastructure components, including the registrar and hosting path, remain viable for potential redeployment. Users who interacted with the site should immediately revoke any entered credentials, enable multi-factor authentication on all financial accounts, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP, while security teams should investigate related indicators for lateral movement or secondary payload delivery. The persistent risk lies in the potential reuse of this infrastructure for future phishing campaigns under similar impersonation tactics.