logon-uphld--en[.]pages[.]dev

The domain logon-uphld--en.pages.dev is a confirmed generic phishing site posing a high-risk threat for credential theft. It does not impersonate a specific brand or deploy a known drainer kit but operates as a broad credential phishing page. As of the latest verification, logon-uphld--en.pages.dev has been taken offline, though prior activity indicates it was actively used for phishing attempts.

Technical indicators confirm the malicious nature of logon-uphld--en.pages.dev. The domain is flagged by 11 of 95 VirusTotal security vendors, including alphaMountain.ai, BitDefender, and CyRadar. Google Safe Browsing classifies it under 'SOCIAL_ENGINEERING' threats, and it appears on one security blocklist (PhishDestroy). Registered through Cloudflare, Inc. on February 21, 2026, the domain resolves to the IP address 172.66.44.151, hosted by Cloudflare in the US. The SSL certificate is issued by Google Trust Services (WE1), and the observed page title was 'Suspected phishing site | Cloudflare'. Technologies detected include HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100.

Victims of logon-uphld--en.pages.dev should immediately change passwords for any accounts accessed during the exposure period, particularly if credentials were entered on the site. Enable two-factor authentication (2FA) on all sensitive accounts to mitigate further risk. Monitor financial and personal accounts for unauthorized activity, and report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in broader takedown efforts.