web-uphold-auth-io[.]pages[.]dev

Analysis of the domain web-uphold-auth-io.pages.dev indicates that it is being leveraged for a generic phishing campaign. The domain was registered on February 21, 2026 through Cloudflare, Inc., and its DNS resolves to the Cloudflare edge address 172.66.46.247, which is associated with ASN 13335 and located in the United States. The site presents a Cloudflare‑issued page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 response, suggesting that the content is blocked or restricted. The TLS certificate in use is issued by Google Trust Services under the WE1 name, confirming that standard HTTPS is enforced via HSTS.

Threat intelligence records show that the domain appears on one security blocklist and has been specifically flagged by PhishDestroy. VirusTotal scans have returned 11 positive detections out of 95 scanners, reflecting consensus among multiple vendors that the domain is malicious. Additionally, Gridinsoft assigns a trust score of 0 out of 100, indicating a high confidence in its malicious nature. The nameservers listed are georgia.ns.cloudflare.com and seth.ns.cloudflare.com, both standard Cloudflare NS records.

While the exact phishing payload or targeted brand is not disclosed in the available data, the combination of blocklist inclusion, multi‑vendor detection, and a zero trust score provides sufficient evidence for defensive action. Organizations should add this domain to URL filtering and DNS sinkhole lists, monitor for any outbound connections to the associated IP, and ensure that endpoint security solutions are updated to reflect the current vendor detections. Continuous re‑evaluation is advised in case the domain is re‑activated or new artifacts emerge.