faq-up-huld-lggin-en[.]created[.]app

The domain faq-up-huld-lggin-en.created.app is presently active and has been classified as a generic phishing infrastructure. Technical analysis shows that the domain resolves to the IP address 216.150.16.1 and is registered through the service Created App, indicating a rapid‑deployment model often used by opportunistic actors. The domain has been observed on three independent security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering solutions, suggesting that multiple threat‑intelligence feeds have correlated malicious activity to this host.

Google Safe Browsing flags the site for social engineering, and VirusTotal reports that six of ninety‑five scanned security vendors have generated detections, reinforcing the presence of malicious payloads or credential‑harvesting techniques. Nameserver information could not be retrieved, which may reflect a transient configuration or intentional obfuscation of the underlying DNS infrastructure. While the available evidence confirms the domain’s involvement in phishing campaigns, details such as the exact page title, SSL certificate attributes, HTTP response codes, and any associated command‑and‑control endpoints remain unverified, leaving a gap in the full behavioral profile.

Defenders are advised to add the domain to internal blocklists, enforce DNS‑level denial of resolution, and monitor outbound connections to the associated IP address for anomalous traffic. Continuous re‑evaluation of threat‑intel feeds is recommended, as further indicators may emerge that clarify the scope of the campaign and any ancillary infrastructure used by the threat actor.