app-uphold--oauth[.]pages[.]dev

Analysis of app-uphold--oauth.pages.dev shows a domain created on February 21, 2026 and registered through Cloudflare, Inc. The domain resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. DNS resolution uses the Cloudflare authoritative nameservers jake.ns.cloudflare.com and arushi.ns.cloudflare.com. An HTTP request returns a 403 status code and the page title presented by Cloudflare reads "Suspected phishing site | Cloudflare," indicating that the hosting provider has flagged the site as malicious. The TLS certificate is issued by Google Trust Services under the WE1 profile, and the site advertises HSTS, Cloudflare, and HTTP/3 support.

Security telemetry shows the domain appears on one public blocklist and has been blocked by PhishDestroy. VirusTotal scans report three of ninety‑three security vendors flagging the domain, reinforcing the malicious classification. Gridinsoft assigns a trust score of zero out of one hundred, and the designated scam type is credential phishing. Current operational status is offline, which limits immediate exposure but does not guarantee that the domain will remain dormant.

Defenders should continue to monitor the IP 188.114.97.3 for any reactivation, enforce blocking of the domain in network and endpoint security controls, and correlate any outbound connections from internal hosts to this IP with known credential‑phishing activity. Because the domain is hosted on a shared Cloudflare infrastructure, additional scrutiny of other domains sharing the same IP may be warranted. Until the domain is definitively retired, it is prudent to treat any traffic to the domain as malicious and to educate users about the risk of credential harvesting attempts associated with this URL.