site-uphold-wallet[.]pages[.]dev

The domain site-uphold-wallet.pages.dev was registered on 21 February 2026 via Cloudflare, Inc. and resolves to 188.114.96.3, an address owned by AS13335 Cloudflare, Inc. in the United States. The domain is currently hosted behind Cloudflare’s infrastructure, employing HSTS and HTTP/3, and presents a valid SSL certificate issued by Google Trust Services (WE1). An HTTP request returns a 403 status, indicating the site is presently inaccessible but was previously reachable. The page title observed in historical captures reads “Wallet Uphold® Registration and Login | Account & Security | Uplold Wallet,” which suggests an attempt to impersonate the Uphold brand and target credential theft. The threat classification recorded is “Credential Phishing” under a broader “brand impersonation” campaign.

Google Safe Browsing has flagged the domain for social engineering, and PhishDestroy has listed it on its blocklist; the domain also appears on a single security blocklist. A Gridinsoft trust score of 0 out of 100 further reflects a malicious reputation. VirusTotal analysis shows that the domain was scanned by 93 engines with no detections reported, but the lack of detections does not constitute evidence of benign intent. The nameservers leah.ns.cloudflare.com and kurt.ns.cloudflare.com confirm the Cloudflare registration.

Uncertainty remains around the exact content served before the site was taken offline, as the 403 response prevents direct verification. No additional intelligence such as OTX tags, malware payloads, or observed phishing kits has been disclosed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation or similar subdomains, and update web filtering rules to include the observed page title and SSL fingerprint.