uphold-com-login-auth[.]pages[.]dev

The domain uphold-com-login-auth.pages.dev was registered on February 21, 2026 through Cloudflare, Inc., and the current analysis shows it is offline with an HTTP 403 response. Technical profiling indicates the site is protected by HSTS and served behind Cloudflare's network (AS13335) from the IP address 188.114.97.3, which resolves to the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming the use of a legitimate certificate chain. The page title returned by the server reads "Suspected phishing site | Cloudflare," which is the default placeholder shown by Cloudflare when a domain is flagged for malicious activity.

The domain is listed on a single public blocklist, PhishDestroy, and has been flagged by 14 of 93 security vendors on VirusTotal, indicating a moderate consensus of malicious intent. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the classification as a credential phishing operation. Nameserver configuration lists emily.ns.cloudflare.com and cartman.ns.cloudflare.com, both operated by Cloudflare. While the exact phishing payload or targeted brand is not visible in the collected data, the combination of a recent registration, Cloudflare hosting, a placeholder page title, and multiple vendor detections supports the elevated risk rating.

Defenders should immediately block the domain and the underlying IP address, add the domain to URL filtering policies, and monitor for any future resolution to the same IP or similar subdomains. Email security gateways should be updated to flag messages referencing this domain, and incident response teams should watch for credential harvesting attempts that may leverage this URL. Continuous re‑assessment is advised, as the offline status may change if the operators reactivate the site.