# upphold-walet.pages.dev — SUSPICIOUS

> upphold-walet.pages.dev impersonates a crypto wallet site to steal funds. Flagged by 2/95 VirusTotal scanners, this Cloudflare-hosted domain resolves to 172.66.

## Summary
PhishDestroy identifies upphold-walet.pages.dev as an active cryptocurrency wallet phishing domain designed to trick users into surrendering private keys or transferring funds. The site presents itself as a legitimate Pages.dev-hosted cryptocurrency wallet interface, luring victims with familiar branding to steal digital assets. Once credentials or seed phrases are entered, attackers gain full control over victims' wallets, enabling immediate fund extraction.  

This domain was flagged by only 2 out of 95 security vendors on VirusTotal, demonstrating how stealthy such attacks can be. It was registered through Cloudflare, Inc. and resolves to IP 172.66.44.164. The use of Google Trust Services for SSL certificates further enhances its credibility, making it harder for users to detect malicious intent. Security teams should block this domain at the network perimeter to prevent access.  

If you’ve visited upphold-walet.pages.dev or entered any sensitive information, immediately revoke wallet access and transfer remaining funds to a clean wallet. Change all related passwords and enable two-factor authentication on all crypto accounts. Report the incident to your wallet provider and monitor blockchain transactions for unauthorized transfers. Avoid future interactions with any Pages.dev-hosted wallet services unless verified through official channels.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.44.164

## Detection Status
- VirusTotal: 2 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/cc96c6ce-f308-4a11-b180-9ca00f6a8718
- PhishDestroy: https://phishdestroy.io/domain/upphold-walet.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/upphold-walet.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/upphold-walet.pages.dev/
Last updated: 2026-03-22