uphol-d-log[.]pages[.]dev

The domain uphol-d-log.pages.dev was created on February 21, 2026 and is currently offline. It is registered through Cloudflare, Inc. and resolves to the IPv6 address 2a06:98c1:3120::3, which belongs to AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are sid.ns.cloudflare.com and tara.ns.cloudflare.com, confirming Cloudflare as the hosting provider. The site presented the page title "Uphold Login - Securely Access Your Digital Assets," which aligns with a wallet/seed phishing campaign targeting Revolut users.

HTTP requests to the domain returned a 403 status code, indicating that the server is refusing access, yet the domain was still identified by security tools. PhishDestroy listed the domain as blocked, and it appears on one external security blocklist. VirusTotal analysis shows that three of ninety-three scanning engines flagged the domain, reinforcing the suspicion of malicious activity. The SSL certificate is issued by Google Trust Services under the WE1 profile, providing a legitimate‑looking HTTPS indicator despite the underlying threat.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence in malicious intent. Defenders should add the domain and its associated IPv6 address to deny‑list rules, monitor for any resurgence of the host, and enforce strict outbound filtering for connections to Cloudflare‑hosted assets that claim to be Revolut login portals. Continuous telemetry from blocklist feeds and VirusTotal should be consulted for any future re‑registration attempts or related infrastructure reuse.