en-us-upheld[.]created[.]app

The domain en-us-upheld.created.app is currently active and serves a page titled “Trade Digital Assets”. Google Safe Browsing has classified the URL under the SOCIAL_ENGINEERING category, indicating a high‑confidence indication of credential‑stealing behavior. The site returns HTTP 200, confirming that the content is being served as expected.

Network analysis shows the domain resolves to the IPv4 address 216.150.1.129, which is owned by a US‑based infrastructure provider known for cloud hosting services. The TLS certificate is issued by Let’s Encrypt and is valid for the current year, suggesting the operators have maintained a legitimate‑looking HTTPS surface. Technology fingerprinting identifies a stack comprising Node.js, React, Next.js, and a content delivery network backed by the same cloud provider, together with feature flagging services and HSTS enforcement.

Reputation services reinforce the malicious assessment: Google Safe Browsing flags the site for social engineering, and VirusTotal reports that five out of ninety‑five scanners have identified the domain as malicious. The domain appears on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple downstream protection platforms have observed abusive activity. Nameserver information could not be retrieved, which may reflect a deliberate attempt to obscure DNS configuration.

Defenders should treat en-us-upheld.created.app as a high‑risk indicator and add it to deny lists across perimeter firewalls, DNS filtering, and endpoint protection solutions. Monitoring for new subdomains under the created.app namespace is advisable, as the observed pattern suggests the infrastructure could be reused for further credential‑harvesting campaigns. Incident response teams should also consider sinkholing traffic to the resolved IP address to disrupt the command‑and‑control flow and to gather additional telemetry on potential victims.