app-doc-uphold-en[.]pages[.]dev

The domain app-doc-uphold-en.pages.dev was registered on February 21, 2026 through Cloudflare, Inc., and is hosted on Cloudflare’s network (ASN 13335) with the IP address 172.66.45.4 located in the United States. DNS resolution uses the Cloudflare nameservers wanda.ns.cloudflare.com and jaime.ns.cloudflare.com. The site presents a page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, indicating that the content is blocked by the provider. Transport security is enforced via HSTS, and the site supports HTTP/3, consistent with Cloudflare‑provided services. The SSL certificate is issued by Google Trust Services under the WE1 identifier, confirming a valid TLS handshake despite the malicious intent.

Reputation services flag the domain as highly suspicious: Scamadviser assigns a trust score of 1 / 100, Gridinsoft reports a score of 0 / 100, and Google Safe Browsing classifies the URL as social engineering. VirusTotal analysis shows that 13 of 93 security vendors have flagged the domain, and the domain appears on a single external blocklist. PhishDestroy has actively blocked the site, and the current operational status is offline, suggesting that the hosting provider has taken takedown action.

The evidence points to a credential‑phishing campaign that likely attempts to harvest login details, although the specific target brand or service is not disclosed in the available data. Defenders should update URL filtering and email gateway rules to block both the domain and its associated IP address, monitor for similar Cloudflare‑hosted subdomains, and enforce multi‑factor authentication for any accounts that could be targeted. Continuous monitoring of Cloudflare‑issued certificates and rapid ingestion of threat‑intel feeds that reference this domain are recommended to mitigate re‑use of the infrastructure in future campaigns.