sso-uphold-wallet-us[.]pages[.]dev

On July 23 2026 the domain sso-uphold-wallet-us.pages.dev was observed to be hosted on Cloudflare infrastructure (AS13335) and resolve to the IP address 172.66.45.8 located in the United States. The domain was registered on February 21 2026 through Cloudflare, Inc., and uses a Google Trust Services / WE1 SSL certificate. DNS resolution returns the Cloudflare‑provided nameservers annalise.ns.cloudflare.com and newt.ns.cloudflare.com. HTTP requests return status code 403 and the page title is “Suspected phishing site | Cloudflare”, indicating that the site is being presented as a generic phishing warning page rather than a functional service. The site employs HSTS, Cloudflare services, and HTTP/3, all of which are typical for domains protected by Cloudflare.

Security telemetry shows the domain is listed on a single blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports nine detections out of ninety‑three scanners, confirming that multiple vendors have flagged the host as malicious. The classification in the intelligence set is “Crypto Scam” with a specific designation of a crypto drainer, suggesting that the domain was intended to lure victims into transferring cryptocurrency assets. The current operational status is offline, and the HTTP 403 response suggests that the content has been taken down or is being shielded by Cloudflare’s protective mechanisms.

No additional content analysis, such as page screenshots or login form extraction, is available, so the exact payload or credential‑harvesting technique remains unknown. Defenders should continue to block the domain at perimeter devices, update URL filtering lists with the observed indicator, and monitor for any resurgence of the same IP address or similar sub‑domains under the pages.dev namespace. Given the low trust score, blocklist presence, and multiple vendor detections, the domain should be treated as high‑confidence malicious.