get-started-public-uphldapp[.]pages[.]dev

This domain is flagged as a high-risk credential phishing site targeting users of the Uphold digital asset platform. Analysis indicates the page mimics a legitimate mobile application security review, titled 'Uphold Mobile Application Architecture and Security Analysis,' to deceive victims into submitting authentication credentials or financial information. The threat type is classified as generic_phishing with a focus on impersonating trusted financial services infrastructure. Infrastructure analysis reveals the domain was registered on March 25, 2026, through Cloudflare Pages, a platform commonly exploited for rapid deployment of phishing pages. It resolves to IP address 172.66.47.153, geolocated to Canada under Cloudflare, Inc. The domain appears on one security blocklist, with detection counts from VirusTotal showing 2 out of 95 security vendors flagging it as malicious. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy. Despite minimal detection at present, the domain remains active and unmitigated. Mitigation requires immediate action from network security teams and end users. Organizations should block the domain and associated IP (172.66.47.153) at the perimeter firewall and DNS filtering layers. Endpoint protection systems should be updated to include this indicator of compromise (IOC) in detection rules. Users are advised to verify the authenticity of any communication or webpage claiming to represent Uphold, particularly those requesting login credentials or sensitive data. Multi-factor authentication (MFA) should be enforced for all financial accounts to reduce the impact of credential theft. Monitoring for similar domains registered under Cloudflare Pages with recent creation dates is recommended to identify related phishing campaigns.