apps-uphold-app-auth[.]pages[.]dev

This investigation documents the infrastructure associated with apps-uphold-app-auth.pages.dev, which was observed as a credential‑phishing site. The domain was registered on 21 February 2026 through Cloudflare, Inc., and its authoritative nameservers are clark.ns.cloudflare.com and sydney.ns.cloudflare.com. DNS resolution points to the IPv6 address 2606:4700:310c::ac42:2c8d, belonging to AS13335 (Cloudflare, Inc.) and geolocated to the United States. The site served content over HTTPS using a certificate issued by Google Trust Services on behalf of the WE1 entity, and the connection employed HSTS and HTTP/3, indicating a modern TLS configuration.

When accessed, the server returned HTTP 403, and the page title presented was “Suspected phishing site | Cloudflare”. VirusTotal recorded 15 detections out of 93 scanned security vendors, reflecting a moderate level of malicious classification. Independent reputation services assigned extremely low scores: Scamadviser rated the domain 1 / 100 and Gridinsoft 0 / 100. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service.

Current observations show the domain is offline, and no further content is reachable for analysis. Consequently, the exact phishing payload, targeted brand, or credential‑collection mechanism remains unknown. Defenders should continue to block the domain at network perimeter devices, update URL filtering rules, and monitor for any re‑registration of the same sub‑domain pattern. Threat‑intel consumers are advised to reference the observed indicators – domain name, IPv6 address, nameserver pair, SSL issuer, and the 403 response – when correlating logs, and to treat any future activity from this namespace as likely malicious until proven otherwise.