uphold-logen-us[.]pages[.]dev

This domain, uphold-logen-us.pages.dev, was observed hosting a credential‑phishing page whose HTML title reads “Suspected phishing site | Cloudflare”. The site was provisioned on 21 February 2026 through Cloudflare, Inc., and is protected by a Google Trust Services / WE1 TLS certificate. DNS resolution points to 172.66.45.26, an address owned by AS13335 Cloudflare, Inc. in the United States. HTTP requests return a 403 status code, and the site is currently offline. Cloudflare’s name‑server configuration lists josh.ns.cloudflare.com and khloe.ns.cloudflare.com, and the service presents HSTS, HTTP/3, and other Cloudflare‑specific technologies.

Reputation services flag the domain as malicious. Twelve of ninety‑three VirusTotal scanners raise detections, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on one public blocklist and is actively blocked by PhishDestroy. The identified scam type is credential phishing, consistent with the page title and the classification in the intelligence feed. Open questions remain regarding the exact payload delivered to victims, the target brand or login portal being spoofed, and any post‑exploitation infrastructure.

No additional indicators such as malicious URLs, payload hashes, or email templates have been disclosed. Defenders should add 172.66.45.26 to network‑level deny lists, enforce DNS filtering for the fully qualified domain name, and monitor for any future re‑registration of the sub‑domain under the same Cloudflare account. Continuous observation of VirusTotal and other sandbox feeds is advised to capture any evolving variants. Organizations should also educate users about unexpected login prompts that resolve to Cloudflare‑hosted subdomains, as these may be used to harvest credentials.