cloud-uphold-eng[.]pages[.]dev

Analysis of cloud-uphold-eng.pages.dev indicates that the domain is being used for credential phishing. The domain was registered on February 21, 2026 through Cloudflare, Inc. and is served by Cloudflare nameservers sam.ns.cloudflare.com and deb.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented a page title of "Suspected phishing site | Cloudflare" and responded with an HTTP 403 status code, suggesting that the content is no longer publicly accessible. SSL termination is provided by a Google Trust Services certificate (WE1), and the site employed modern web technologies including HTTP/3 and HSTS, consistent with typical Cloudflare-hosted infrastructure.

Reputation data shows a Gridinsoft trust score of 0 out of 100 and the domain appears on one security blocklist, where it is specifically blocked by PhishDestroy. VirusTotal analysis recorded nine detections out of ninety‑three scanned security vendors, reinforcing the malicious assessment. The overall risk level is classified as elevated, and the threat type is identified as generic credential phishing.

Current status is offline, indicating that the phishing page has been taken down or is no longer serving content. However, the observable indicators—recent registration, Cloudflare hosting, low trust score, blocklist presence, multiple vendor detections, and the explicit page title—provide sufficient evidence for defenders to treat the domain as malicious. Security teams should continue to block the domain at perimeter defenses, monitor for any re‑use of the associated IP address or nameservers, and include the domain in threat intelligence feeds. Further investigation is limited by the lack of publicly accessible content, so any future activity from the same infrastructure should be examined in the context of credential harvesting campaigns.