uphold-logim[.]pages[.]dev

uphold-logim.pages.dev was registered through Cloudflare on 21 February 2026 and began serving content shortly thereafter. The site now reports a 403 response and is listed as taken offline. DNS resolution points to 172.66.47.52, an address owned by Cloudflare, Inc. (ASN 13335) located in the United States. The connection is protected by a Google Trust Services / WE1 certificate and the server advertises HSTS and HTTP/3, confirming the use of Cloudflare’s CDN and security stack.

The page title returned by the server is “Suspected phishing site | Cloudflare,” which aligns with the classification of credential phishing provided in the intelligence feed. Gridinsoft assigns a trust score of 0 out of 100, and PhishDestroy has already blocked the domain. VirusTotal analysis shows that 12 of 93 scanning engines have flagged the domain, indicating a moderate level of consensus among security vendors. The domain appears on one external blocklist, further corroborating its malicious reputation.

Because the site is currently offline, dynamic content cannot be inspected, and the exact phishing payload or target brand remains unknown. Nevertheless, the combination of a low trust score, multiple vendor detections, blocklist presence, and the explicit “Suspected phishing site” title provides sufficient evidence for defensive teams to treat the domain as hostile. Recommended mitigation steps include adding the domain to perimeter firewalls and DNS filtering solutions, updating internal threat‑intel feeds with the observed indicators (IP 172.66.47.52, Cloudflare nameservers javier.ns.cloudflare.com and rosa.ns.cloudflare.com, and the Google‑issued certificate), and monitoring for any future re‑hosting attempts that may use the same certificate or Cloudflare configuration. User‑focused awareness campaigns should reinforce the risks of credential harvesting, especially given the generic nature of the site.