classify-uphld-walles-en-us[.]pages[.]dev

This domain, classify-uphld-walles-en-us.pages.dev, is identified as a credential theft operation. Analysis indicates the site was designed to harvest user login credentials through deceptive login portals, likely mimicking legitimate services to trick victims into entering sensitive information. No direct brand impersonation or crypto drainer kit signatures were observed, but the infrastructure aligns with common credential harvesting tactics. The domain exhibits no overt branding, suggesting a generic or opportunistic attack vector rather than a targeted campaign against a specific organization. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on October 27, 2025, and resolves to the IP address 172.66.44.83, hosted on AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1), a common configuration for malicious domains leveraging free certificate authorities. Google Safe Browsing flags the domain as phishing, and VirusTotal reports 9 out of 95 security vendors detecting the domain as malicious. The domain appears on one security blocklist, and the page title explicitly labels it as a suspected phishing site, further corroborating its malicious intent. The domain is currently offline, having been taken down following detection. However, residual risk remains due to the potential for infrastructure reuse or re-registration under a similar naming scheme. Organizations should monitor for related domains or IPs, particularly those leveraging Cloudflare Pages infrastructure with similar naming patterns (e.g., randomized subdomains or brand-adjacent keywords). Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Network-level blocking of the resolved IP (172.66.44.83) is recommended as a precautionary measure.