upheld-ai[.]created[.]app

This domain, upheld-ai.created.app, is assessed as a high-risk site specifically for credential theft. The domain has been taken offline, but it remains critical to understand the technical and threat indicators associated with it to prevent future incidents.

Analysis indicates that 17 out of 95 security vendors on VirusTotal flag this domain as malicious, and it is listed on the Google Safe Browsing list for social engineering. The domain was registered through Tucows Domains Inc and resolves to the IP address 216.150.16.1. It appears on three security blocklists and has a Gridinsoft trust score of 0/100, indicating a complete lack of trustworthiness. The site was built using technologies such as Node.js, React, Google Cloud, Vercel, Next.js, and LaunchDarkly, and it had an HSTS header and Google Cloud CDN enabled, suggesting a sophisticated setup to mimic legitimate infrastructure. The SSL certificate was issued by Let's Encrypt, which is commonly used by both legitimate and malicious actors.

To mitigate the risk of credential theft, users should avoid entering any personal or financial information on sites that are flagged by multiple security vendors or appear on blocklists. It is recommended to verify the URL and SSL certificate of any site before logging in. Additionally, using multi-factor authentication (MFA) and regularly updating passwords can significantly reduce the likelihood of credentials being compromised. Organizations should also implement network-level protections and educate employees on recognizing and reporting phishing attempts.