uphld-eng[.]pages[.]dev

The domain uphld-eng.pages.dev was created on February 21, 2026 and is registered through Cloudflare, Inc. It resolves to the IP address 188.114.96.3, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. DNS resolution uses the Cloudflare authoritative nameservers cortney.ns.cloudflare.com and graham.ns.cloudflare.com. An HTTPS service is presented with a certificate issued by Google Trust Services under the WE1 profile, indicating a valid TLS handshake but offering no proof of legitimacy. The site returns HTTP status 403 and the page title displayed is "Suspected phishing site | Cloudflare," which aligns with a credential‑phishing classification.

Reputation checks show a Gridinsoft trust score of 0 / 100 and the domain appears on one security blocklist. It has been blocked by PhishDestroy and is flagged by Google Safe Browsing for social engineering. VirusTotal analysis reports that ten of ninety‑five scanned security vendors flagged the domain, reinforcing the malicious assessment. The domain is currently offline, and its status is recorded as taken offline.

While the available data confirm the presence of phishing‑related indicators, the specific target of the credential collection, the phishing kit employed, and any associated command‑and‑control infrastructure remain unknown. Defenders should continue to block the domain at network perimeter devices, update URL filtering and endpoint protection lists, and monitor the associated IP address for any resurgence of malicious activity. Further investigation of historic traffic logs may reveal victim interaction patterns and help attribute the campaign to a broader threat actor group.