uphuld-io-login[.]pages[.]dev

Analysis of uphuld-io-login.pages.dev shows a domain created on February 21, 2026 and hosted behind Cloudflare’s network (ASN 13335, United States). The site resolves to the IPv6 address 2a06:98c1:3120::3 and uses Cloudflare‑provided nameservers novalee.ns.cloudflare.com and dion.ns.cloudflare.com. TLS termination is performed by a Google Trust Services certificate issued to WE1, indicating a valid HTTPS handshake. The page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, suggesting the content is being blocked or taken offline.

Reputation services reflect extreme distrust: Gridinsoft assigns a trust score of 0 / 100, Scamadviser a score of 1 / 100, and the domain appears on at least one security blocklist. PhishDestroy has explicitly blocked the domain, and VirusTotal reports that 15 of 93 scanning engines flag the host as malicious. The listed scam type is credential phishing, confirming the intent to harvest login credentials.

HSTS and HTTP/3 are enabled, typical of modern Cloudflare‑protected sites, but provide no indication of benign use. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration attempts, and consider adding the IPv6 address to threat‑intel feeds. The limited public evidence prevents a full attribution of the threat actor, but the combination of low trust scores, blocklist presence, and multiple vendor detections strongly supports a malicious classification.