uphold-help-io[.]pages[.]dev

Analysis indicates that uphold-help-io.pages.dev was provisioned on February 21 2026 and is hosted behind Cloudflare’s edge network (ASN 13335, United States). DNS resolution points to 172.66.44.206 and the authoritative name servers are syeef.ns.cloudflare.com and oaklyn.ns.cloudflare.com, confirming that the domain is fully managed by Cloudflare, Inc. The site presented a HTTP 403 response at the time of observation and employed HSTS and HTTP/3, suggesting modern TLS configuration. The SSL certificate is issued by Google Trust Services under the WE1 profile, a common certificate for Cloudflare‑protected sites.

Threat intelligence flags the domain as a credential phishing campaign. VirusTotal recorded 12 detections out of 93 scanners, and the site is listed on a single external blocklist and has been blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious assessment. The page title returned by the server is “Suspected phishing site | Cloudflare”, which is a generic placeholder rather than a brand‑specific landing page.

Given the limited public artifacts, the exact target brand or login portal being spoofed cannot be confirmed. The evidence points to a fast‑flux‑style deployment using Cloudflare’s CDN to mask the origin and to leverage reputable TLS certificates, a tactic frequently observed in credential‑stealing operations. Defenders should continue to block the domain at network perimeter, update URL filtering lists with the known IP and host, and monitor for any future re‑registration or similar sub‑domains that resolve to the same Cloudflare edge IP range. Additional analysis of the content served when the site is re‑enabled would be required to identify the specific credential collection vectors.