en-us-uphlld[.]pages[.]dev

Analysis of the domain en-us-uphlld.pages.dev indicates a high-risk credential phishing campaign that was active as of July 2026. The domain, registered through Cloudflare, Inc. on February 21, 2026, resolves to the IP address 172.66.44.211, which is hosted on Cloudflare's infrastructure (AS13335) in the United States. The site was flagged by Google Safe Browsing for social engineering, a classification consistent with phishing activity targeting user credentials. At the time of assessment, the domain returned an HTTP 403 status, and its page title explicitly read 'Suspected phishing site | Cloudflare,' further corroborating its malicious classification.

Detection metrics reveal limited but conclusive evidence of compromise: the domain appears on one security blocklist (PhishDestroy), and 11 of 93 security vendors on VirusTotal flagged it as malicious. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites frequently leverage valid certificates to appear legitimate. Infrastructure analysis shows the domain uses Cloudflare nameservers (alexandra.ns.cloudflare.com and aaden.ns.cloudflare.com) and enforces HSTS, a security header that does not negate the site's fraudulent intent. Gridinsoft assigned the domain a trust score of 0/100, reflecting its confirmed malicious status.

While the exact content of the phishing page remains unanalyzed, the available evidence—including the scam type classification as 'Credential Phishing'—suggests the site was designed to harvest login credentials. Defenders should treat this domain as compromised and ensure it is blocked at the network and endpoint levels. Given its current offline status, no active threat is posed, but historical logs should be reviewed for prior exposure. Further investigation into related infrastructure or connected campaigns may be warranted based on the domain's registration and hosting patterns.