htp-up-hlod[.]pages[.]dev

The domain htp-up-hlod.pages.dev was registered on 27 March 2026 and is currently hosted behind Cloudflare’s network, resolving to IP address 172.66.44.107 located in Canada. The site presents the page title “Login to Uphold | Manage Your Crypto”, indicating a credential‑phishing campaign targeting users of the Uphold platform. TLS is provided by a Google Trust Services certificate (WE1) and the server enforces HSTS while supporting HTTP/3, confirming the use of modern web security features. The domain appears on a single security blocklist and has been flagged by PhishDestroy; VirusTotal reports a single positive out of 94 scanners, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. Infrastructure analysis shows the domain uses Cloudflare’s default nameservers derek.ns.cloudflare.com and harleigh.ns.cloudflare.com, and no additional hosting or CDN services are observed. While the page content has not been directly examined, the combination of a brand‑specific login title, recent creation date, and the observed security vendor detections strongly suggest an active credential‑phishing operation. Defenders should block the domain at network perimeters, monitor DNS queries for this FQDN, and add it to endpoint allow‑lists as a known threat. Email security gateways should be tuned to flag messages containing URLs that resolve to 172.66.44.107 or reference the “Uphold” login phrasing. Continued observation is recommended to detect any shifts in hosting or additional indicators.