uphold--login--sso[.]pages[.]dev

This domain, uphold--login--sso.pages.dev, operates as a credential harvesting site designed to steal login credentials for financial platforms. The site mimics legitimate single sign-on (SSO) portals, tricking users into entering sensitive account information such as usernames, passwords, and potentially multi-factor authentication codes. Such stolen credentials are often used for unauthorized account access, financial fraud, or sold on underground markets for further exploitation. The threat primarily targets individuals expecting to log into financial services, making it particularly dangerous for users of cryptocurrency or banking platforms. Analysis indicates this domain is a confirmed phishing threat based on multiple technical indicators. The domain was registered on November 04, 2025, through Cloudflare, Inc., and is flagged by 17 out of 95 security vendors on VirusTotal. It resolves to the IP address 188.114.96.3, which is part of AS13335 (Cloudflare, Inc.) infrastructure located in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites due to its free availability. The domain appears on at least one security blocklist, and its page title, 'Suspected phishing site | Cloudflare,' suggests Cloudflare's automated systems have also identified suspicious activity. If you visited uphold--login--sso.pages.dev or entered any credentials, immediate action is required to mitigate risk. First, change the passwords for any accounts accessed through the site, prioritizing financial or email accounts. Enable multi-factor authentication (MFA) if not already active, using app-based or hardware tokens rather than SMS-based methods. Monitor the affected accounts for unauthorized transactions or login attempts and review connected devices or sessions for suspicious activity. Consider placing a fraud alert or credit freeze with relevant financial institutions if banking or payment details were entered. Finally, scan your device for malware, as phishing sites may deploy additional payloads to capture further data.