overview-upheld-wallet[.]pages[.]dev

The domain overview-upheld-wallet.pages.dev was registered on February 21, 2026 and resolves to the Cloudflare‑owned address 172.66.44.237 located in the United States under ASN 13335. Hosting is provided by Cloudflare, Inc., as indicated by the registrar and the two Cloudflare‑named nameservers daisy.ns.cloudflare.com and kianchau.ns.cloudflare.com. The HTTPS service presents a certificate issued by Google Trust Services (WE1), and the site advertises HSTS and HTTP/3 support, consistent with Cloudflare’s default configuration. An HTTP request returns a 403 status code, and the page title returned by the server is “Uphold Wallet — Secure Digital Asset Management”, which mimics the legitimate Uphold brand. The threat profile classifies the activity as a crypto‑scam that impersonates the Ethereum brand.

Google Safe Browsing flags the URL for social engineering, and one of ninety‑three VirusTotal scanners flagged the domain as malicious. The domain appears on a single security blocklist and is currently listed as offline by the reporting source. PhishDestroy also reports the domain as blocked. A Gridinsoft trust score of 0 out of 100 further indicates a high likelihood of malicious intent.

No additional analysis of page content or payloads is available, and the limited vendor detection suggests the sample may be recent or low‑visibility. Defenders should block the domain at the DNS or proxy level, monitor for any outbound connections to 172.66.44.237, and include the indicator in threat‑intel feeds. Ongoing observation of Cloudflare‑hosted infrastructure for similar impersonation patterns is recommended, as the same hosting provider is frequently abused for fast‑flux phishing campaigns. The lack of public evidence beyond the listed indicators leaves the exact payload unknown, so security teams should treat any interaction with the domain as potentially hostile.