center-uphold-lgin[.]pages[.]dev

This domain is flagged for hosting a credential-harvesting phishing portal targeting users of a financial service platform. Analysis indicates the site impersonates legitimate login interfaces to capture usernames, passwords, and multi-factor authentication tokens, posing an elevated risk of account compromise and subsequent fraudulent transactions. Infrastructure analysis reveals the domain center-uphold-lgin.pages.dev was registered on October 10, 2025, through Cloudflare, Inc. and resolves to the IP address 172.66.44.214, associated with AS13335. The SSL certificate is issued by Google Trust Services (WE1), a common pattern in phishing campaigns leveraging free certificates. Security vendors on VirusTotal flag the domain at a 12/95 detection rate, and it appears on one security blocklist. The page title Suspected phishing site | Cloudflare suggests automated detection by the hosting provider, which subsequently took the site offline. Mitigation requires immediate action from both end users and network administrators. Users who accessed the domain should reset credentials for any financial service accounts, enable multi-factor authentication if not already active, and monitor accounts for unauthorized activity. Network administrators should block the domain and its resolving IP (172.66.44.214) at the firewall or DNS level, and deploy indicators of compromise (IOCs) across security tools. Organizations should also implement email filtering rules to quarantine messages containing the domain or related keywords, and conduct user awareness training to recognize phishing tactics, particularly those mimicking financial service logins.