fine-uphold-en-us[.]pages[.]dev

This report details a credential phishing threat identified on the domain fine-uphold-en-us.pages.dev. The page title, "Suspected phishing site | Cloudflare," indicates the site was blocked by Cloudflare's security systems. The domain impersonated the Uphold cryptocurrency platform, as suggested by the domain name, to steal user login credentials. The primary threat is credential theft, where victims entering their Uphold account details would have them captured by the attackers.

Technical analysis confirms the malicious nature of the site. VirusTotal shows 12 out of 95 security vendors flagged the domain as malicious, with detections from alphaMountain.ai, BitDefender, CyRadar, ESET, and Emsisoft. Google Safe Browsing flagged the site for "SOCIAL_ENGINEERING." The domain was registered with Cloudflare, Inc. and created on November 4, 2025. It resolved to IP address 172.66.44.86, hosted in the United States under AS13335 Cloudflare, Inc. The SSL certificate was issued by Google Trust Services. The domain uses nameservers clara.ns.cloudflare.com and carter.ns.cloudflare.com.

The site is currently offline and inaccessible. The GridinSoft trust score is 0 out of 100, and the domain risk score is 100, indicating a maximum threat level. The domain is listed on one blocklist. Given the confirmed phishing activity and high-risk indicators, this domain represents a critical threat to Uphold users and should be permanently blocked.