app-upheld-docs[.]created[.]app

The phishing domain app-upheld-docs.created.app is currently offline, but it has been flagged as malicious by 2 out of 91 vendors on VirusTotal. PhishDestroy identified this threat on June 22, 2026, and it is also listed on public blocklists from MetaMask and SEAL. The domain was hosted on an Amazon server in the US, with an IP address of 216.150.1.129, and used a Let's Encrypt SSL certificate.

This domain was likely involved in a generic phishing operation, given the absence of a specific brand being imitated. The platform risk score for this domain stands at 78 out of 100, indicating a significant threat level. Despite being taken down, its presence on multiple blocklists suggests it was actively targeting users before it went offline.

The quick detection by PhishDestroy highlights the importance of early threat identification. Phishing domains often exploit the time gap between their registration and when antivirus databases update their records. This domain's presence on blocklists and its VirusTotal detections emphasize the need for continuous monitoring and proactive measures to protect against such threats.