uphelh-io-nav[.]pages[.]dev

Analysis of uphelh-io-nav.pages.dev shows a confirmed crypto‑focused phishing operation. The domain was registered on 31 October 2025 through Cloudflare, Inc., and resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution uses the Cloudflare nameservers koa.ns.cloudflare.com and ulla.ns.cloudflare.com, and the site served an HSTS header and HTTP/3 support, indicating a modern web stack. An SSL certificate issued by Google Trust Services under the WE1 root was observed, confirming that the site presented a valid TLS handshake despite its malicious intent.

The HTTP response returned a 403 status, which may reflect a restrictive configuration after the domain was taken offline. The page title captured during the brief exposure reads "Sign In to Uphold — Secure Wallet Login for Crypto & Assets," aligning with the listed scam type of a crypto scam and suggesting that the page attempted to harvest credentials for the Uphold wallet service. Reputation checks show a Gridinsoft trust score of 0 / 100 and a VirusTotal detection rate of 11 out of 95 scanning engines flagging the domain as malicious. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service.

Current status is offline, but the infrastructure—Cloudflare hosting, a valid TLS certificate, and the use of HSTS/HTTP‑3—remains reusable for future campaigns. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP range for new hostnames, and update endpoint protection signatures to include the observed VirusTotal detections. Threat intel consumers should treat any email or message referencing a "Uphold" login prompt as suspect, especially if it originates from URLs under the pages.dev subdomain, and enforce multifactor authentication for affected accounts.