uphold-log--in[.]pages[.]dev

Analysis of the domain uphold-log--in.pages.dev indicates a credential phishing operation targeting users of a financial platform. The domain, registered on February 21, 2026, through Cloudflare, Inc., currently resolves to the IP address 188.114.97.3, which is part of AS13335 (Cloudflare, Inc.) and geolocated in the US. Infrastructure analysis reveals the use of Cloudflare nameservers (cullen.ns.cloudflare.com, kara.ns.cloudflare.com) and technologies including HSTS and HTTP/3, alongside a Cloudflare-hosted frontend that returned an HTTP 403 status at the time of assessment. Google Safe Browsing categorizes the domain as engaging in social engineering, while PhishDestroy has implemented a block.

The domain appears on one security blocklist, and 13 out of 93 security vendors on VirusTotal flag it as malicious. Gridinsoft assigns a trust score of 0/100, further supporting the classification of high-risk phishing activity. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious Cloudflare-hosted sites. The page title, 'Suspected phishing site | Cloudflare,' suggests Cloudflare’s automated detection systems may have identified and labeled the content prior to takedown.

The domain is currently offline, though defenders should treat any prior resolution or DNS queries as indicators of compromise. No specific phishing kit or targeted brand beyond the domain’s naming convention (uphold-log--in) is confirmed in the available data. While the domain structure implies an attempt to mimic Uphold, a digital money platform, this cannot be verified without additional forensic evidence. Organizations are advised to block the domain, IP, and associated nameservers at perimeter controls and monitor for related credential theft or follow-on attacks.