pop-upheld[.]pages[.]dev

Analysis of the domain pop-upheld.pages.dev indicates it was a credential-phishing site targeting Uphold users, now offline as of July 23, 2026. The page title, 'Uphold Login™ | Secure Sign-In Guide ⚡,' explicitly suggests an attempt to mimic the legitimate Uphold login interface, though no direct visual confirmation of the site’s content is available. The domain was flagged by Google Safe Browsing for social engineering and appears on at least one security blocklist. Twelve out of 95 security vendors on VirusTotal detected the domain as malicious, reinforcing its classification as a high-risk threat. Infrastructure analysis reveals the domain was hosted on Cloudflare’s network (AS13335) at IP address 172.66.45.44, located in the United States.

It was registered through Cloudflare on February 21, 2026, and used Cloudflare nameservers (zainab.ns.cloudflare.com and rex.ns.cloudflare.com). The SSL certificate was issued by Google Trust Services (WE1), a common practice for both legitimate and malicious sites leveraging Cloudflare’s services. The site employed HTTP/3 and HSTS, technologies that do not inherently indicate malicious intent but are frequently used to lend an appearance of legitimacy. At the time of reporting, the domain returned an HTTP 403 status, indicating access was restricted or the site had been taken down.

Gridinsoft assigned a trust score of 0/100, further supporting its classification as malicious. While the exact phishing kit or post-compromise behavior remains unconfirmed, the available evidence—including the page title, detection by multiple security vendors, and Safe Browsing flags—strongly suggests this was a credential-harvesting operation. Defenders should treat any credentials potentially entered on this domain as compromised and monitor for related follow-up attacks, such as account takeovers or financial fraud.