upheldd[.]created[.]app

This domain is flagged as a high-risk credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the infrastructure is designed to mimic legitimate authentication portals, increasing the likelihood of successful credential theft. Infrastructure analysis reveals the domain was registered on May 21, 2026, through Tucows Domains Inc and currently resolves to the IP address 216.150.16.65. It appears on three security blocklists and is flagged by 15 out of 95 security vendors on VirusTotal. Additional detection sources include MetaMask, PhishDestroy, and SEAL, while Google Safe Browsing categorizes it under SOCIAL_ENGINEERING. The domain employs technologies such as Node.js, React, Google Cloud, Vercel, and Next.js, alongside a Let’s Encrypt SSL certificate, which may enhance its perceived legitimacy. Gridinsoft assigns a trust score of 0/100, further confirming its malicious nature. Mitigation requires immediate blocking of the domain and its associated IP address (216.150.16.65) at the network perimeter. Users should be educated on recognizing phishing indicators, such as mismatched URLs, unexpected login prompts, and suspicious SSL certificate issuers. Organizations should enforce multi-factor authentication (MFA) to reduce the impact of credential theft. Security teams are advised to monitor for related domains registered under the same registrar or resolving to the same IP range, as these may indicate further phishing campaigns.