official-uphald-wallet[.]pages[.]dev

Analysis indicates that the domain official-uphald-wallet.pages.dev was registered on March 24 2026 through Cloudflare, Inc. and points to the Cloudflare edge address 188.114.97.3 located in Canada. The site serves content over HTTPS with HSTS enabled and utilizes HTTP/3, confirming modern web stack usage. The TLS certificate is issued by Google Trust Services under the WE1 label, which is typical for legitimate Google‑issued certs but does not guarantee benign intent. The page title observed during a scan reads “What Makes Uphold Wallet the Best Choice for Secure Crypto Management?”, matching a wallet‑related social‑engineering lure. Google Safe Browsing has classified the URL as a social‑engineering threat, and the domain appears on a single external blocklist.

Independent scanning on VirusTotal returned detections from 15 of 94 antivirus engines, reinforcing malicious reputation. The Gridinsoft trust score is 0 out of 100, indicating an extremely low confidence rating. The HTTP response returned a 403 status code, and the domain is currently taken offline, suggesting active takedown or self‑removal. PhishDestroy has also listed the domain as blocked. The documented scam type is Wallet/Seed Phishing, which aligns with the observed title and the broader crypto‑drainer campaign.

No further indicators such as payload hashes, command‑and‑control endpoints, or phishing page screenshots are available. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same IP or Cloudflare nameservers, and add the observed certificate fingerprint to allowlists only after verification. Endpoint security solutions should flag any attempts to contact this host, and users should be warned that any credential or seed entry on sites claiming to be Uphold Wallet is likely fraudulent. Ongoing vigilance is recommended, as the infrastructure (Cloudflare edge) can be repurposed for future campaigns.