app-uphold-cdn--auth[.]pages[.]dev

app-uphold-cdn--auth.pages.dev is currently offline but remains listed as a credential‑phishing site. The domain was registered on February 21 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.47.138, which is advertised as belonging to AS13335 Cloudflare, Inc. in the United States. The site returns HTTP 403, and the page title presented by the server is “Suspected phishing site | Cloudflare”. Google Safe Browsing classifies the URL as a social‑engineering threat, and PhishDestroy has already added the domain to its blocklist. VirusTotal reports that 13 of 93 scanned security vendors flag the domain as malicious, and it appears on one additional public blocklist.

Reputation services give extremely low scores: Scamadviser rates it 1 / 100 and Gridinsoft rates it 0 / 100. The TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming that HTTPS is terminated at Cloudflare. Detected technologies include HSTS, HTTP/3, and the Cloudflare CDN. The nameservers daphne.ns.cloudflare.com and lennon.ns.cloudflare.com are consistent with the registrar’s default configuration.

The evidence points to a short‑lived infrastructure used to host credential‑phishing content, but the site is no longer reachable, limiting any behavioural analysis. No additional artefacts such as login pages or payloads have been observed, and the exact target brand has not been disclosed in the available metadata. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the IP address or related Cloudflare‑hosted subdomains, and update detection rules to include the observed SSL issuer and HTTP status pattern. Ongoing watch of VirusTotal, Google Safe Browsing, and PhishDestroy alerts is recommended to capture any future re‑use of the same naming pattern.