upheld-log-in[.]created[.]app

This domain, upheld-log-in.created.app, is identified as a credential theft operation designed to harvest user login credentials. Analysis indicates no direct association with a specific brand or crypto drainer kit, but the infrastructure aligns with broad credential harvesting campaigns. The page title, 'Homepage,' suggests a generic login portal, likely mimicking legitimate services to deceive users into submitting sensitive information. Technical indicators confirm the domain's malicious nature. upheld-log-in.created.app is flagged by 11 out of 95 security vendors on VirusTotal, placing it in the high-risk category. The domain was registered through Name.com, Inc., and currently resolves to the IP address 216.150.16.193. It appears on three security blocklists, and its SSL certificate is issued by Let's Encrypt (R13). While the exact creation date is not provided, the domain's presence on multiple blocklists and its offline status suggest prior malicious activity. As of the latest assessment, upheld-log-in.created.app has been taken offline, reducing immediate risk to users. However, the infrastructure may resurface under a different domain or IP address. Users who interacted with this domain should assume credential exposure and take proactive measures, including password resets and monitoring for unauthorized account activity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. The remaining risk lies in potential reuse of the infrastructure or targeting of users who previously engaged with the site.