get-uphold-login-eng[.]pages[.]dev

This report details a credential phishing threat targeting users of the Uphold financial platform. The domain get-uphold-login-eng.pages.dev was configured to impersonate the legitimate Uphold login interface, as indicated by its deceptive subdomain structure. The page title, "Suspected phishing site | Cloudflare," confirms the site was blocked for malicious activity. The primary threat is credential theft, where victims would have entered their login details, leading to account compromise and potential financial loss.

Technical evidence confirms the malicious nature of this domain. VirusTotal analysis shows 13 detections out of 95 security vendors. Google Safe Browsing flagged the site for "SOCIAL_ENGINEERING." Specific vendors detecting the threat include ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, and ESET. The domain was registered on 2025-11-05 through Cloudflare, Inc., and hosted on IP address 188.114.96.3 (US, AS13335 Cloudflare, Inc.). SSL/TLS certificates were issued by Google Trust Services (WE1). Nameservers were romina.ns.cloudflare.com and leonidas.ns.cloudflare.com.

The domain is currently offline and inaccessible. The overall risk is assessed as critical, with a DOM risk score of 100 out of 100 and a GridinSoft trust rating of 0 out of 100. The site appears on one blocklist. Users who may have interacted with this domain before it was taken down are advised to change their Uphold credentials immediately and enable multi-factor authentication.