web-cd-uphold-io[.]pages[.]dev

This domain, web-cd-uphold-io.pages.dev, is flagged as a high-risk generic phishing site targeting users of the Uphold digital money platform. Analysis indicates the infrastructure was designed to mimic legitimate Uphold verification portals, likely to harvest login credentials, authentication tokens, or financial details. No specific drainer kit signatures were identified in the available telemetry, though the domain structure and naming convention strongly suggest intent to deceive users into believing they are interacting with an official Uphold service. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.66.44.173, hosted on Cloudflare’s network (AS13335). It was registered through Cloudflare, Inc. on November 04, 2025, with an SSL certificate issued by Google Trust Services (WE1). Google Safe Browsing has classified this domain as phishing, and it appears on one security blocklist. VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious, with detections including credential theft and phishing-related classifications. As of the latest verification, the domain has been taken offline, and the page title now reads 'Suspected phishing site | Cloudflare,' indicating remediation by the hosting provider. However, residual risk remains for users who may have interacted with the domain prior to its takedown, particularly if credentials or sensitive data were entered. Organizations and individuals are advised to monitor for unauthorized access attempts, rotate exposed credentials, and implement multi-factor authentication where possible. Network-level blocking of the IP address 172.66.44.173 and domain-based filtering are recommended to prevent potential re-emergence or related infrastructure reuse.