cdn-app-uphold[.]pages[.]dev

The domain cdn-app-uphold.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.44.58, located in the United States under ASN 13335. The site presents the page title "Suspected phishing site | Cloudflare" and has been classified as a credential phishing operation. An HTTP 403 response indicates that the page is presently inaccessible; the host has been taken offline and is marked as offline in the current status. The SSL certificate is issued by Google Trust Services under the WE1 series, confirming a valid TLS termination on the Cloudflare network.

Infrastructure analysis shows the domain is protected by HSTS and HTTP/3, consistent with standard Cloudflare services. Reputation services provide extremely low scores: Gridinsoft registers a 0/100 trust rating and Scamadviser a 1/100 rating, reflecting the high confidence of malicious intent. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal scans reported 11 detections out of 93 antivirus engines, reinforcing the suspicion of malicious activity.

Nameserver delegation to simon.ns.cloudflare.com and cortney.ns.cloudflare.com aligns with the registrar’s infrastructure. No additional content or payload has been captured beyond the page title; therefore, the exact phishing lures or targeted credential collections remain unverified. Defenders should continue to block the domain at perimeter filters, update URL reputation feeds with the observed indicators, and monitor for any re‑hosting attempts on alternative Cloudflare‑controlled IP ranges. Continued observation of DNS changes and re‑activation attempts is recommended, as the low trust scores and vendor detections suggest a persistent threat actor may attempt to resurrect the site.