uphold-en-log-in[.]pages[.]dev

The domain uphold-en-log-in.pages.dev was observed for the first time on February 21, 2026, when it was registered through Cloudflare, Inc. The registration utilizes Cloudflare’s default nameservers demi.ns.cloudflare.com and maciej.ns.cloudflare.com, indicating the infrastructure is fully hosted behind Cloudflare’s edge network. DNS resolution points to IP address 172.66.45.28, which belongs to Cloudflare’s data centre in California. The site returns an HTTP 403 status code and presents the page title “Suspected phishing site | Cloudflare”, which is a generic warning page supplied by Cloudflare when a request is blocked. Google Safe Browsing has classified the domain as a social‑engineering threat, and PhishDestroy lists it on a blocklist.

The domain appears on one additional security blocklist, and nine of ninety‑three VirusTotal scanners have flagged it, reinforcing the malicious assessment. Automated security scoring services assign a trust score of 0 out of 100, reflecting a high confidence of abuse. Detected technologies include HTTP/3, HSTS, and the Cloudflare CDN, all of which are typical for fast‑forwarded malicious hosting. The current operational status is offline, suggesting the hosting has been taken down or the content removed.

What remains uncertain is the specific target brand or credential set the site attempted to harvest, as no landing page content has been captured beyond the generic Cloudflare warning. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration or similar sub‑domains, and update detection rules to include the exact host name. Additional investigation of the nine VirusTotal detections may reveal payload characteristics or associated command‑and‑control infrastructure, which can be incorporated into broader threat‑intel feeds.