en-uphold-logo[.]pages[.]dev

Analysis of en-uphold-logo.pages.dev indicates that the domain was created on 21 February 2026 and is hosted on Cloudflare infrastructure. The domain resolves to the IPv6 address 2606:4700:310c::ac42:2f9e, which is part of AS13335 owned by Cloudflare, Inc., and is geolocated to the United States. The site presents the page title "Suspected phishing site | Cloudflare" and currently returns an HTTP 403 status, indicating that the content has been taken offline. Cloudflare‑provided security technologies are observed, including HTTP/3 and HSTS, and the SSL certificate is issued by Google Trust Services under the WE1 certificate profile.

The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy feed. VirusTotal records show that ten of ninety‑three scanning vendors flagged the domain, reinforcing the presence of malicious activity. Additional reputation data from Gridinsoft assigns the domain a trust score of zero out of one hundred, reflecting a high confidence of abuse. Nameserver records point to simon.ns.cloudflare.com and cortney.ns.cloudflare.com, both standard Cloudflare authoritative servers.

The known intelligence classifies the threat as credential phishing, but no specific target brand or content details have been disclosed, and the site is no longer reachable for further inspection. Defenders should immediately block traffic to the domain and its associated IPv6 address, enforce outbound filtering for Cloudflare‑hosted endpoints exhibiting similar characteristics, and monitor the listed blocklists for any re‑appearance. Continuous observation of Cloudflare’s abuse reporting channels is recommended, as the provider may issue takedown notices for similar phishing deployments.