uphol-d-en-us[.]pages[.]dev

This domain operates as a phishing portal designed to harvest credentials by mimicking legitimate Cloudflare authentication interfaces. Analysis indicates the site likely targeted users attempting to access Cloudflare services, presenting fraudulent login prompts to capture account details. The infrastructure was structured to exploit trust in the Cloudflare brand, potentially leading to unauthorized access to victim accounts or further malicious activity such as account takeovers or data exfiltration. Evidence supporting this assessment includes detection by 9 out of 95 security vendors on VirusTotal, registration through Cloudflare, Inc. on October 17, 2025, and presence on one security blocklist. The domain resolved to the IP address 172.66.45.13, associated with Cloudflare's AS13335, and was flagged by Google Safe Browsing for phishing. The SSL certificate, issued by Google Trust Services (WE1), further aligns with tactics used to lend legitimacy to fraudulent sites. Users who visited this domain should immediately revoke any entered credentials, particularly for Cloudflare or related accounts. Monitor linked accounts for unauthorized activity and enable multi-factor authentication where available. Network administrators are advised to block the domain and associated IP address 172.66.45.13 in perimeter defenses. If financial or sensitive data was submitted, consider reporting the incident to relevant authorities for further investigation.