logn-uphold-web[.]pages[.]dev

Analysis of logn-uphold-web.pages.dev indicates a credential phishing domain hosted on Cloudflare Pages infrastructure, now offline as of July 25, 2026. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolved to IP 188.114.97.3 (AS13335, Cloudflare, Inc., US). Nameservers amy.ns.cloudflare.com and ethan.ns.cloudflare.com further confirm Cloudflare hosting. The SSL certificate, issued by Google Trust Services (WE1), aligns with Cloudflare’s standard configuration, and HTTP Strict Transport Security (HSTS) and HTTP/3 were detected, typical of Cloudflare-protected sites.

At the time of assessment, the domain returned an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare,' suggesting Cloudflare’s automated or manual intervention. Google Safe Browsing flagged the domain for social engineering, and it appears on one security blocklist. Gridinsoft assigned a trust score of 0/100, reflecting high-risk classification. Nine of 93 security vendors on VirusTotal flagged the domain, though the absence of additional context limits interpretation of these detections.

The scam type is classified as credential phishing, though the specific brand or service targeted remains unconfirmed due to the lack of detailed page content analysis. Defenders should treat this domain as malicious, particularly in environments where Uphold or similar financial platforms are used. The domain’s offline status reduces immediate risk, but historical DNS and WHOIS records should be preserved for forensic purposes. Monitoring for re-registration or re-emergence under similar naming conventions is recommended.