uphlod-logix[.]pages[.]dev

uphlod-logix.pages.dev is currently flagged as a credential phishing site. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.44.238, which is associated with ASN 13335 in the United States. Both authoritative nameservers are Cloudflare‑operated (anita.ns.cloudflare.com, milan.ns.cloudflare.com). The site presents a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1). An HTTP request returns status 403, and the page title reported by the scanner is “Suspected phishing site | Cloudflare”, indicating that the host has been taken offline or blocked by Cloudflare’s protective pages.

The infrastructure advertises HSTS and HTTP/3, confirming modern web stack usage. Reputation checks show a Gridinsoft trust score of 0 / 100 and a detection rate of nine positive votes out of ninety‑three security vendors on VirusTotal. The domain appears on a single public blocklist and is listed as blocked by PhishDestroy. The scam type is classified as credential phishing, though no target brand or specific payload details are available. Uncertainty remains around the original phishing content because the site is offline and only the generic “Suspected phishing site” title is visible.

No additional indicators such as malicious payload hashes, phishing page screenshots, or observed credential harvest URLs have been disclosed. Defenders should immediately add 172.66.44.238 to network blocklists, enforce DNS filtering for uphlod‑logix.pages.dev, and monitor Cloudflare‑owned IP ranges for similar short‑lived domains. Continuous re‑scanning of the domain is advisable in case the site reactivates. Logging of attempted connections to the IP address can help identify compromised clients. Because the domain uses legitimate Cloudflare services, standard URL‑filtering products that rely on blocklist entries are the most reliable mitigation vector.