home-uphold-log-en[.]pages[.]dev

Analysis of the domain home-uphold-log-en.pages.dev shows a short-lived credential phishing infrastructure that was taken offline as of the report date, July 23, 2026. The site returned an HTTP 403 status and the page title displayed "Suspected phishing site | Cloudflare," indicating that Cloudflare’s automated takedown page is active. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the IP address 172.66.44.100, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. TLS termination is provided by a Google Trust Services / WE1 certificate, confirming that encrypted connections are possible but offering no assurance of legitimacy.

Reputation data is uniformly negative: Gridinsoft assigned a trust score of 0 / 100, and eight of ninety‑three VirusTotal scanners flagged the domain as malicious. The domain appears on one external security blocklist and was blocked by the PhishDestroy service, reinforcing the consensus that it is associated with credential phishing. Detected technologies include HSTS, Cloudflare’s edge services, and HTTP/3, all typical of Cloudflare‑hosted sites. Nameservers are sam.ns.cloudflare.com and deb.ns.cloudflare.com, confirming the use of Cloudflare’s DNS.

No additional intelligence, such as the specific brand being spoofed or the exact credential payload, is available from the collected data. Defenders should immediately block the domain and its resolved IP address at perimeter and DNS layers, monitor for any newly registered subdomains under the same registrar or similar naming patterns, and enforce multi‑factor authentication to mitigate potential credential reuse. Continuous threat‑intel feeds should be consulted for any re‑appearance of the domain or related indicators of compromise.