en-us-uphold--login[.]pages[.]dev

The domain en-us-uphold--login.pages.dev was created on February 21, 2026 and is registered through Cloudflare, Inc. It resolves to the IP address 172.66.44.131, which belongs to AS13335 Cloudflare, Inc. and is geo‑located in the United States. The site presents a page title of "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, indicating that access is being denied, likely as part of the takedown process. Technical fingerprints show the presence of HSTS, Cloudflare services and HTTP/3, and the TLS certificate is issued by Google Trust Services under the WE1 designation, confirming a valid HTTPS endpoint despite the malicious intent. Detection data show that the domain appears on a single public blocklist and is actively blocked by PhishDestroy.

Google Safe Browsing has flagged the site for social engineering, and VirusTotal reports that 11 of 93 security vendors have flagged the domain, reinforcing the suspicion of credential phishing activity. The Gridinsoft trust score of 0 out of 100 further reflects a malicious classification. Nameservers tessa.ns.cloudflare.com and tate.ns.cloudflare.com are consistent with Cloudflare‑provided DNS. Current status indicates the site is offline, which limits direct observation of payloads or login capture mechanisms.

However, the combination of registrar information, hosting under a known CDN, the low trust score, and multiple vendor detections provides a strong indicator that the domain was used for credential phishing. Defenders should continue to block the domain at network perimeter devices, update URL filtering policies, and monitor for any resurgence of the domain or similar sub‑domains under the pages.dev suffix. Additional threat‑intel feeds should be consulted for potential associations with other malicious infrastructure, and any inbound traffic to the resolved IP should be logged and investigated for signs of attempted credential harvesting.