uphold-review[.]created[.]app

This domain, uphold-review.created.app, is identified as a high-risk phishing portal designed to impersonate the Uphold digital asset platform. Analysis indicates the site presents a fraudulent login interface under the title 'Uphold Login - Secure Digital Asset Platform | Access Your Crypto Wallet,' targeting users of the legitimate Uphold service. The infrastructure is engineered to harvest credentials and potentially facilitate unauthorized access to cryptocurrency wallets, aligning with known patterns of crypto phishing and brand impersonation. No direct evidence of a drainer kit was observed, though the presence of credential capture mechanisms suggests a likely secondary payload or redirection to malicious endpoints. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to the IP address 216.150.1.65 and is registered through Tucows Domains Inc. It is flagged by 13 out of 95 security vendors on VirusTotal, with detections spanning phishing, social engineering, and malicious web content categories. The domain appears on three security blocklists and is explicitly labeled as 'SOCIAL_ENGINEERING' by Google Safe Browsing. Detected technologies include Node.js, React, Google Cloud, Vercel, and Next.js, which are consistent with modern phishing frameworks but do not inherently indicate malicious intent. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and fraudulent sites due to its accessibility and lack of cost. At the time of assessment, the domain has been taken offline, likely in response to detection by multiple security mechanisms, including MetaMask, PhishDestroy, and SEAL. Despite its current inactive status, residual risk remains due to the potential for re-deployment under a different domain or IP address. Users who may have interacted with the site are advised to immediately revoke any active sessions, reset credentials, and monitor associated accounts for unauthorized transactions. Organizations should update blocklists to include the domain and its resolved IP, while security teams are encouraged to analyze historical DNS and proxy logs for connections to 216.150.1.65 or related indicators. The Gridinsoft trust score of 0/100 further corroborates the high-risk classification of this infrastructure.