auth-uphold-cdn-auth[.]pages[.]dev

This domain, auth-uphold-cdn-auth.pages.dev, operates as a credential harvesting phishing site designed to steal login credentials for financial services. The site mimics legitimate authentication portals, likely targeting users of cryptocurrency or banking platforms by presenting fake login interfaces that capture entered usernames, passwords, and multi-factor authentication codes. Such attacks enable unauthorized account access, financial theft, or further exploitation through compromised credentials. Analysis indicates the domain was registered on October 31, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, hosted on Cloudflare's infrastructure (AS13335). Security vendors on VirusTotal flagged the domain in 11 out of 95 scans, confirming its malicious intent. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. The domain appears on one security blocklist and was proactively taken offline following detection. Users who visited auth-uphold-cdn-auth.pages.dev should immediately change passwords for any accounts entered on the site, particularly those linked to financial services. Enable multi-factor authentication on all sensitive accounts if not already active. Monitor accounts for unauthorized transactions or login attempts, and report any suspicious activity to the affected service provider. If personal or financial information was submitted, consider placing a fraud alert on credit reports. Avoid interacting with any links or attachments received from unknown sources, and verify the legitimacy of authentication portals by cross-checking URLs with official service domains.