acc-uphold-login[.]pages[.]dev

The domain acc-uphold-login.pages.dev was registered through Cloudflare on 21 February 2026 and resolves to the Cloudflare edge address 188.114.96.3 (AS13335, United States). The site is protected by Cloudflare services, presenting HSTS and HTTP/3 support and a TLS certificate issued by Google Trust Services under the WE1 label. DNS is served by leif.ns.cloudflare.com and coco.ns.cloudflare.com. When queried the HTTP response returned a 403 status code and the page title reported by the server is “Suspected phishing site | Cloudflare”. Google Safe Browsing classifies the URL as social engineering, and VirusTotal records indicate that 13 of 95 scanned security vendors flagged the domain as malicious.

The Gridinsoft trust score is 0 out of 100, and the domain appears on a single external blocklist. PhishDestroy has taken the site offline, and the current status is listed as offline. Analysis confirms that the domain is being used for credential phishing, as indicated by the scam type label in the intelligence feed. The combination of a low trust score, multiple vendor detections, and a Google Safe Browsing flag provides strong evidence of malicious intent.

However, no public samples of the page content or the credential collection mechanism have been released, so the exact login workflow and targeted service remain unknown. Defenders should block DNS resolution for acc-uphold-login.pages.dev at the network perimeter, add the address 188.114.96.3 to any host‑based deny lists, and ensure that web filtering solutions reference the Google Safe Browsing and VirusTotal detections. Continuous monitoring of Cloudflare‑hosted subdomains is advised, as the attacker may shift to a new sub‑domain under the same parent zone. Incident response teams should treat any credential submissions to this domain as compromised and advise affected users to reset passwords immediately.