# help-uphlld-secure-io.pages.dev — MALICIOUS

> Avoid help-uphlld-secure-io.pages.dev—flagged for credential phishing and social engineering. This site is offline but remain cautious.

## Summary
PhishDestroy identifies help-uphlld-secure-io.pages.dev as a credential phishing domain designed to deceive users into divulging sensitive login information. The domain is classified under high-risk social engineering threats, aiming to impersonate legitimate services to harvest credentials.

Technical indicators reveal the domain was registered recently on February 21, 2026, through Cloudflare, Inc., leveraging their page hosting service. The domain appears on multiple security blocklists and is flagged by Google Safe Browsing for social engineering. VirusTotal analysis shows significant detection by 13 security vendors, confirming its malicious intent.

Currently, help-uphlld-secure-io.pages.dev has been taken offline, reducing immediate risk. However, its infrastructure and tactics highlight ongoing attempts at credential phishing. Users and organizations should remain vigilant, avoid interacting with suspicious domains, and maintain updated security measures to protect against similar threats.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.47.53
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["sue.ns.cloudflare.com", "kellen.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 13 vendors flagged
  Vendors: ["ADMINUSLabs", "BitDefender", "Chong Lua Dao", "CyRadar", "ESET", "Fortinet", "G-Data", "Google Safebrowsing", "Kaspersky", "Lionic", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: FLAGGED
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019ab899-fa21-748a-81a4-950eda05afad.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/1340bd3b-6d76-438d-8b1e-a364f4403f9d
- PhishDestroy: https://phishdestroy.io/domain/help-uphlld-secure-io.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/help-uphlld-secure-io.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/help-uphlld-secure-io.pages.dev/
Last updated: 2026-03-19