home-uphold-ion[.]pages[.]dev

This domain operates as a credential harvesting phishing site targeting users of financial platforms, specifically mimicking authentication portals to capture login credentials. Analysis indicates the infrastructure was designed to deceive victims into entering sensitive account details, which would then be transmitted to threat actors for unauthorized access or financial fraud. The domain employs social engineering tactics, including visually convincing replicas of legitimate financial service interfaces, to lower user suspicion during interaction. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered through Cloudflare, Inc. on November 04, 2025, and currently resolves to the IP address 188.114.97.3, associated with AS13335. Security vendors on VirusTotal flagged the domain at a ratio of 12/95, while it appears on one additional security blocklist. The SSL certificate, issued by Google Trust Services (WE1), was likely provisioned automatically, a common tactic to lend superficial legitimacy to phishing sites. The page title, 'Suspected phishing site | Cloudflare,' suggests prior detection by automated systems. Users who visited home-uphold-ion.pages.dev should immediately revoke any entered credentials from associated financial accounts. Monitor accounts for unauthorized transactions, enable multi-factor authentication where available, and review connected devices or sessions for suspicious activity. If credentials were submitted, assume compromise and rotate passwords for all accounts sharing the same or similar login details. Security teams should add the domain and its resolving IP (188.114.97.3) to network blocklists to prevent further exposure. No legitimate services are hosted on this infrastructure, and any interaction should be treated as a potential security incident.