auth-login-uphold-eng[.]pages[.]dev

This domain, auth-login-uphold-eng.pages.dev, operates as a credential harvesting site designed to impersonate legitimate authentication portals. Analysis indicates the infrastructure targets users attempting to access financial or cryptocurrency services, tricking them into submitting login credentials, multi-factor authentication codes, or other sensitive account details. The phishing page employs visual mimicry of a well-known platform, leveraging social engineering tactics to exploit user trust and urgency. Infrastructure analysis reveals the domain was registered on October 28, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.131, associated with AS13335. The domain appears on one security blocklist and is flagged by 11 out of 95 security vendors on VirusTotal as malicious. Google Safe Browsing has classified this domain as phishing, and the SSL certificate is issued by Google Trust Services (WE1). The page title, 'Suspected phishing site | Cloudflare,' further confirms its deceptive nature, as legitimate services do not self-identify as suspicious. Users who visited auth-login-uphold-eng.pages.dev should immediately revoke any submitted credentials and enable multi-factor authentication on the legitimate service being impersonated. Monitor accounts for unauthorized transactions or access attempts, and report the incident to the targeted platform’s security team. If personal or financial data was entered, consider placing a fraud alert on credit files and reviewing recent account activity for anomalies. Network administrators should block the domain and associated IP address (172.66.47.131) to prevent further exposure within their environments.