get-upheeld-us[.]pages[.]dev

Analysis indicates that the domain get-upheeld-us.pages.dev was provisioned on 21 February 2026 and immediately used to host a credential‑phishing page titled “Uphold Exchange Login | Manage Your Crypto Portfolio”. The site was served behind Cloudflare (ASN 13335) from the IP address 172.66.44.226, which is geolocated to the United States. The SSL certificate presented is issued by Google Trust Services under the WE1 intermediate, confirming the use of a legitimate certificate chain despite the malicious intent. The page employed HSTS and HTTP/3, consistent with modern Cloudflare deployments, and the nameservers are desiree.ns.cloudflare.com and kyrie.ns.cloudflare.com, both owned by Cloudflare. Threat intelligence sources have classified the content as credential phishing targeting the Uphold exchange platform.

The domain appears on a single security blocklist and has been flagged by PhishDestroy. On VirusTotal, one of ninety‑three scanning engines reported a detection, reinforcing the malicious classification. Independent trust scoring from Gridinsoft assigned a score of 0 / 100, indicating an extremely low reputation. An HTTP request to the site returned a 403 status code, and the current operational status is recorded as offline, suggesting that the phishing page has been taken down or is otherwise inaccessible. Defenders should add get‑upheeld‑us.pages.dev to blocklists at the network perimeter and within endpoint protection suites.

Monitoring for newly created subdomains under the pages.dev suffix that resolve to Cloudflare‑owned IP ranges, especially those presenting similar page titles, can help detect repeat attempts. Because the infrastructure relies on Cloudflare’s shared hosting, rule sets that flag rapid domain creation followed by immediate use of reputable SSL certificates should be considered. Continuous review of the single vendor detection on VirusTotal may reveal additional indicators if the domain reappears.