welcome-upholed[.]pages[.]dev

Analysis as of July 24, 2026 indicates that welcome-upholed.pages.dev is a credential phishing site that has been taken offline. The page title observed during the brief availability – “Uphold Login | Access Your Digital Wallet with Security & Ease” – suggests an attempt to impersonate the Uphold service, and the intelligence record lists the brand target as “across”, confirming a broad impersonation campaign. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.46.210, which belongs to AS13335 in the United States. HTTP requests return a 403 status code, and the site served HSTS, Cloudflare, and HTTP/3 headers, indicating use of a modern CDN configuration.

The SSL certificate is issued by Google Trust Services under the WE1 identifier, providing a legitimate‑looking TLS connection. Google Safe Browsing flags the domain for social engineering, and ten of ninety‑three VirusTotal scanners have raised detections, reinforcing the malicious classification. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. Reputation services assign a Gridinsoft trust score of 0 out of 100, reflecting extreme risk.

Nameservers micah.ns.cloudflare.com and gwen.ns.cloudflare.com are consistent with the registrar’s infrastructure. Because the site is currently offline, content‑level analysis such as form fields or branding assets cannot be verified, and no additional malware payloads have been observed. Defenders should immediately block the domain and its associated IP address at perimeter and DNS layers, add the nameserver pair to watch lists for any future sub‑domains, and monitor Cloudflare‑owned AS13335 for related activity. Continuous re‑scanning is advised in case the site reappears, and any credential submissions captured from users should be treated as compromised.