uphold-us-en-cdn[.]pages[.]dev

The domain uphold-us-en-cdn.pages.dev was created on February 21, 2026 and is registered through Cloudflare, Inc. DNS resolution points to IP address 172.66.44.212, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Access attempts return HTTP 403, and the page title presented by the server is "Suspected phishing site | Cloudflare," indicating that the hosting provider has taken down the content. Google Safe Browsing classifies the domain as social engineering, and PhishDestroy has already blocked it. The domain appears on a single security blocklist and has been flagged by twelve of ninety‑five VirusTotal scanners, reflecting a modest but notable detection rate.

Reputation services assign extremely low trust scores: Gridinsoft reports 0/100 and Scamadviser reports 1/100, reinforcing the malicious assessment. Technical fingerprints show the use of Cloudflare’s edge services, including HSTS, HTTP/3, and a TLS certificate issued by Google Trust Services / WE1. Nameservers aaden.ns.cloudflare.com and gail.ns.cloudflare.com confirm the reliance on Cloudflare’s DNS infrastructure.

While the exact phishing lure or targeted brand is not disclosed beyond the generic credential‑phishing classification, the evidence collectively demonstrates a high‑risk malicious infrastructure. Defenders should add uphold-us-en-cdn.pages.dev to URL filtering and intrusion‑prevention rules, monitor outbound connections to the associated Cloudflare IP range, and ensure that endpoint protection solutions are updated to reflect the twelve VirusTotal detections. Continuous observation of Cloudflare‑hosted domains with similar trust‑score anomalies is advised, as the provider’s bulk registration model can enable rapid re‑deployment of comparable threat actors.