upheldcom--logn[.]pages[.]dev

This domain, upheldcom--logn.pages.dev, is flagged as a generic phishing infrastructure designed to harvest user credentials through fraudulent login interfaces. Analysis indicates no direct association with a specific brand or drainer kit, though its structure suggests a template-based approach common in credential theft campaigns. The site was hosted on Cloudflare Pages, a platform frequently abused for rapid deployment of phishing pages due to its free tier and SSL provisioning. Infrastructure analysis reveals the following technical indicators: VirusTotal returned 0 detections out of 95 engines, indicating low initial detection rates. The domain was registered through Cloudflare, Inc. on April 05, 2026, with resolution to the IP address 188.114.96.3, a Cloudflare-operated endpoint. Gridinsoft assigned a trust score of 0/100, and the domain appears on three security blocklists, including MetaMask, PhishDestroy, and SEAL. The SSL certificate is issued by Google Trust Services, a common feature in phishing sites to mimic legitimacy. Current status shows the domain has been taken offline, likely due to Cloudflare's automated or manual suspension processes. While no longer active, the infrastructure may reappear under a different subdomain or top-level domain. Remaining risk includes potential reuse of the same IP or registrar for future phishing campaigns. Users are advised to verify login portals via official sources, monitor for unauthorized access, and report any suspicious domains to security teams for further analysis.