restart-uphold[.]pages[.]dev

restart-uphold.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. The domain resolves to 172.66.44.92, which belongs to AS13335 Cloudflare in the United States. Cloudflare’s edge services provide HSTS and HTTP/3, and the TLS certificate is issued by Google Trust Services (WE1). The site returned HTTP 403 at the time of observation, indicating the content is presently inaccessible. The page title reported by scanners is “Login® | Uphold* — Trade Digital Assets Securely”, suggesting an attempt to mimic the login interface of the Uphold digital‑asset platform. The threat classification in the intelligence set is “Brand Impersonation” with a generic “across” target, meaning the actor may be leveraging the same infrastructure to impersonate multiple brands.

Detection evidence shows the domain is listed on one public blocklist and has been blocked by the PhishDestroy service. Google Safe Browsing flags the URL for social‑engineering content. VirusTotal analysis recorded three detections out of ninety‑three scanning engines, reinforcing the malicious classification. Gridinsoft assigned a trust score of zero out of one hundred, and the overall risk level is marked as elevated. The domain’s nameservers are ganz.ns.cloudflare.com and isla.ns.cloudflare.com, both owned by Cloudflare.

Because the site is currently offline, real‑time content cannot be examined, but the combination of a brand‑specific page title, low trust score, multiple vendor detections, and active blocklist entries indicates a high likelihood of credential‑harvesting activity. Defenders should add 172.66.44.92 to network‑level deny lists, block the domain at DNS resolvers, and monitor for future re‑hosting on other Cloudflare edge nodes. Continuous observation of Cloudflare‑registered subdomains that reuse similar naming patterns (e.g., “restart‑*”) is recommended.