apps-uphold-cdn-autth[.]pages[.]dev

Analysis of the domain apps-uphold-cdn-autth.pages.dev indicates a high-risk credential phishing operation. The domain was registered on February 21, 2026, through Cloudflare, Inc., and is currently offline with an HTTP 403 status. Infrastructure analysis reveals it resolves to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335) in the United States. The SSL certificate is issued by Google Trust Services (WE1), and the domain employs HSTS and HTTP/3 technologies, typical of modern web infrastructure but also commonly abused by threat actors to lend legitimacy. Google Safe Browsing has flagged this domain for social engineering, a classification consistent with credential phishing.

The page title, 'Suspected phishing site | Cloudflare,' further corroborates this assessment, as it aligns with Cloudflare's automated detection of malicious content. The domain appears on at least one security blocklist, specifically PhishDestroy, and has been assigned a Gridinsoft trust score of 0/100, indicating no trustworthiness. Eleven out of 93 security vendors on VirusTotal have flagged this domain as malicious, providing additional evidence of its fraudulent nature. While the exact content of the phishing page is not available for analysis, the scam type is classified as credential phishing based on available intelligence.

The domain's use of Cloudflare Pages and the naming convention 'apps-uphold-cdn-autth' suggests an attempt to impersonate a legitimate service, though no specific brand is confirmed in the provided data. Defenders should treat this domain as compromised and block access to it across all networks. Given its current offline status, monitoring for reactivation or related domains with similar naming patterns is recommended. No further infrastructure anomalies, such as unusual nameservers or hosting providers, were identified beyond the use of Cloudflare's services.