web-uphild[.]created[.]app

This domain is flagged as a credential harvesting phishing site targeting users through deceptive login portals. Analysis indicates it was designed to mimic legitimate authentication pages, tricking visitors into submitting sensitive credentials such as usernames, passwords, and multi-factor authentication codes. The infrastructure was likely used in targeted campaigns against financial, cryptocurrency, or corporate platforms, given its presence on specialized security blocklists. Evidence confirms the domain was registered through Tucows Domains Inc. on February 28, 2026, and resolved to the IP address 216.150.1.129, hosted on AS16509 (Amazon.com, Inc.). It appears on three security blocklists and is detected by 21 out of 95 security vendors on VirusTotal. The domain used a Let’s Encrypt SSL certificate (R13), which, while standard for encryption, is frequently exploited by threat actors to lend false legitimacy to phishing pages. The 404 error currently displayed suggests the site has been taken offline, though historical activity remains a concern. Users who visited web-uphild.created.app should immediately revoke any credentials entered on the site, particularly if they resemble login portals for banking, email, or cryptocurrency services. Monitor accounts for unauthorized access and enable multi-factor authentication where available. If financial or sensitive data was exposed, report the incident to relevant authorities and consider a credit or identity monitoring service. Network administrators should block the domain and IP address 216.150.1.129 in perimeter defenses to prevent future exposure.