uphold--wallet-cdn[.]pages[.]dev

This domain, uphold--wallet-cdn.pages.dev, has been flagged as a suspected crypto drainer and is classified as a high-risk threat. The domain was created on February 21, 2026, and is currently offline, returning an HTTP status code of 403. The domain resolves to the IP address 172.66.47.105, which is located in the United States and is part of Cloudflare, Inc.'s infrastructure (AS13335). Google Safe Browsing has marked this domain for social engineering, indicating potential phishing activity.

The exact content of the website has not been analyzed, but the page title suggests it is a suspected phishing site. The domain is also blocked by PhishDestroy, a known security tool, and appears on one security blocklist. Gridinsoft has assigned a trust score of 0/100, indicating a very low level of trust. The domain is registered through Cloudflare, Inc., and the SSL certificate is issued by Google Trust Services / WE1.

Security technologies detected on the domain include HTTP Strict Transport Security (HSTS), Cloudflare, and HTTP/3. Analysis indicates that this domain was likely used to target users of crypto wallets and could have been part of a larger scam operation. Defenders should ensure that this domain is blocked in their network security policies and educate users about the risks of visiting untrusted sites, particularly those impersonating legitimate crypto services. Regularly reviewing and updating security blocklists can help mitigate the risk of similar threats.