web-upzlogin[.]created[.]app

Analysis conducted on July 23 2026 indicates that the domain web-upzlogin.created.app is actively resolving to the IPv4 address 216.150.16.1. The domain is hosted under the registrar Created App and the authoritative name server information could not be retrieved, as the nameserver lookup returned NS_NOT_FOUND. The infrastructure appears to be singular; the domain is listed on a single security blocklist, where it is explicitly flagged by PhishDestroy for credential phishing.

No additional detections from other vendors are present in the supplied intelligence. The lack of further public markings such as Safe Browsing entries, OTX references, or SSL certificate details limits the depth of the current profiling. Because the domain is still resolving and is classified as a credential phishing site, defensive operators should treat the host as malicious.

Recommended mitigations include adding the IP address 216.150.16.1 to deny lists, blocking DNS resolution for web-upzlogin.created.app at the recursive resolver level, and monitoring for any outbound connections to that address. Continuous re‑evaluation is advised, as additional indicators such as page content, HTTP response codes, or certificate fingerprints may emerge in future scans. At present, the observable evidence is confined to the active DNS resolution, the single blocklist entry, and the registration details, leaving the exact payload or targeted brand undisclosed.