uplold-login[.]pages[.]dev

Analysis of uplold-login.pages.dev indicates a high‑risk credential phishing infrastructure that was taken offline prior to the report date of July 24, 2026. The domain was registered on February 21, 2026 through Cloudflare, Inc., and both authoritative nameservers (dave.ns.cloudflare.com and raina.ns.cloudflare.com) are hosted by Cloudflare. Technical fingerprinting shows the site enforced HTTP Strict Transport Security (HSTS) and leveraged Cloudflare’s edge services, with the domain resolving to IP address 172.66.44.173, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The TLS certificate presented was issued by Google Trust Services under the WE1 intermediate, confirming a valid HTTPS endpoint despite the site’s malicious purpose.

An HTTP 451 response code was returned, indicating the content was unavailable for legal reasons, which aligns with the page title "Unavailable For Legal Reasons" observed during the final request. Google Safe Browsing flagged the domain for social engineering, and PhishDestroy listed it as a blocked credential phishing site. VirusTotal scans recorded 12 detections out of 93 security vendors, and the domain appears on a single public blocklist, reinforcing the consensus that it is malicious.

The primary uncertainty lies in the specific phishing lure or target brand, as no page content or login form details were captured before takedown. Defenders should block the domain at perimeter firewalls, update DNS filtering policies to include the identified nameservers and IP address, and monitor for any re‑registration attempts that reuse the same subdomain pattern. Continuous telemetry from URL filtering services and endpoint protection should be correlated with the observed detections to ensure rapid containment of any resurgence.