web-uphol-com[.]pages[.]dev

This domain is classified as a high-risk credential harvesting phishing site targeting user authentication data. Analysis indicates the infrastructure was designed to mimic legitimate services while capturing login credentials, a common tactic in targeted phishing campaigns. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on November 10, 2025, and resolved to IP address 172.66.44.78 (AS13335, United States). The SSL certificate was issued by Google Trust Services (WE1), and the page title explicitly stated 'Suspected phishing site | Cloudflare.' Security vendors flagged the domain with 11/95 detections on VirusTotal, while Google Safe Browsing and PhishDestroy both categorized it as phishing. The domain appears on one security blocklist and is currently offline. Mitigation requires immediate action for potentially exposed users. Organizations should reset credentials for any accounts that may have interacted with this domain, particularly if login attempts occurred between its creation and takedown. Network administrators should block the domain and associated IP (172.66.44.78) at the perimeter, while endpoint protection systems should be updated to include this indicator of compromise. Users should be educated on recognizing Cloudflare-hosted subdomains used in phishing attempts, as threat actors frequently exploit legitimate hosting services to evade detection.