eng-upheld-apps[.]pages[.]dev

Analysis of eng-upheld-apps.pages.dev confirms active phishing infrastructure hosted on Cloudflare Pages. The domain resolves to IP 172.66.44.235 and uses Cloudflare nameservers (conrad.ns.cloudflare.com, paislee.ns.cloudflare.com), consistent with Cloudflare's hosting services. As of July 29, 2026, the domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, indicating confirmed malicious activity targeting users. Google Safe Browsing flags the domain for social engineering, further supporting its classification as a phishing threat.

VirusTotal reports 10 of 91 security vendors flagging the domain, though the specific detection rules or payloads are not detailed in available intelligence. Infrastructure analysis reveals the domain is registered through Cloudflare, Inc., leveraging its hosting and DNS services to obscure origin details. The lack of additional context—such as the targeted brand, phishing kit, or exact payload—limits deeper attribution, but the combination of blocklist presence, vendor detections, and Safe Browsing flags confirms its status as a high-risk phishing site.

Defenders should treat this domain as malicious and implement blocking at the DNS or network level. Organizations using MetaMask or similar wallet services should ensure users are warned against interacting with this domain, as it may attempt to harvest credentials or deploy malicious scripts. Further investigation into the domain's HTTP responses, SSL certificate details, or associated subdomains may yield additional indicators, but current evidence is sufficient to classify it as an active threat.