login-uphuld-cdn[.]pages[.]dev

PhishDestroy has analyzed the domain login-uphuld-cdn.pages.dev, which was engaged in credential phishing by impersonating Cloudflare. The site attempted to steal login credentials from unsuspecting users by mimicking a legitimate Cloudflare login page. No specific drainer kit was identified, but the threat type is clear credential theft targeting Cloudflare customers.

Technical indicators for this domain include a VirusTotal detection rate of 12/95 security vendors flagging it as malicious. The domain was registered through Cloudflare, Inc. and resolved to IP address 188.114.97.3. It was created on November 01, 2025, and is listed on one security blocklist. Google Safe Browsing has flagged the domain as phishing, confirming its malicious intent.

As of the latest check, the domain is offline, with the page title reading "Suspected phishing site | Cloudflare," indicating that Cloudflare itself has taken action to block the site. This response is appropriate, as the domain has been effectively neutralized. However, users who may have interacted with the site before takedown should change their Cloudflare credentials immediately and monitor for any suspicious activity. PhishDestroy recommends avoiding any similar domains and enabling multi-factor authentication on all accounts.