uprowallet-adminpanel-1u9[.]pages[.]dev

Analysis indicates that the domain uprowallet-adminpanel-1u9.pages.dev was registered on September 02, 2020 through Cloudflare, Inc. The site resolves to the Cloudflare edge address 172.66.46.227, which is associated with AS13335 and located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, confirming that the connection is encrypted but does not imply legitimacy. The HTTP response returned a 403 status code, and the page title reported by the crawler is “Suspected phishing site | Cloudflare”. The domain is classified as a crypto drainer according to the supplied intelligence, and it appears on a single security blocklist. VirusTotal scans show that eight of ninety‑five antivirus engines flagged the domain, reinforcing the malicious assessment.

Additional telemetry includes the presence of HTTP/3, HSTS, and Cloudflare infrastructure, as well as a Gridinsoft trust score of zero out of one hundred, indicating a lack of trust. The nameserver set consists of adi.ns.cloudflare.com, dora.ns.cloudflare.com, gerardo.ns.cloudflare.com, and karl.ns.c, all under Cloudflare control. The domain has been taken offline and is currently blocked by PhishDestroy. Uncertainty remains regarding the exact payload or phishing page content, as no visual analysis is available.

The limited blocklist presence and modest VirusTotal detection count suggest that the site may have been short‑lived or targeted at a narrow audience. Defenders should continue to block the domain at perimeter firewalls, update URL filtering feeds with the observed indicators, and monitor for any resurgence of the same sub‑domain pattern. Because the infrastructure relies on Cloudflare’s shared network, related sub‑domains created by the same registrant may appear on other IP addresses; therefore, threat‑intel teams should watch for new domains registered through Cloudflare that resolve to the same ASN or exhibit similar TLS characteristics.