doc-uphold-wallet[.]pages[.]dev

The domain doc-uphold-wallet.pages.dev was observed hosting a crypto drainer site that has been taken offline as of the report date. VirusTotal recorded ten detections out of ninety‑three scanning engines, indicating that multiple security vendors identified malicious behavior. Google Safe Browsing classifies the URL as a social‑engineering threat, and the site appears on one external blocklist, currently listed by PhishDestroy. The HTTP response returned a 403 status code, while the server advertised HSTS, Cloudflare services, and HTTP/3 support. The TLS certificate was issued by Google Trust Services under the WE1 identifier, confirming a valid HTTPS endpoint at the time of capture.

Network analysis shows the domain resolves to IP address 172.66.47.92, which belongs to AS13335 owned by Cloudflare, Inc., and is geolocated in the United States. Registration data indicate the domain was created on 21 February 2026 and was provisioned through Cloudflare, Inc., using the nameservers steven.ns.cloudflare.com and priscilla.ns.cloudflare.com. The page title returned by the server reads “Suspected phishing site | Cloudflare,” matching the classification of a crypto‑related scam. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low reputation of the host.

The available evidence confirms that the infrastructure is hosted on a legitimate CDN, but the combination of vendor detections, Safe Browsing flag, low trust score, and blocklist listing suggests the domain was actively used for a crypto‑draining operation. No additional indicators such as payload hashes, command‑and‑control endpoints, or victim reports have been released, leaving the exact method of credential or wallet compromise unknown. Defenders should immediately block the domain and its associated IP in perimeter and DNS filters, monitor for any future re‑registration of the same sub‑domain pattern, and consider adding the observed nameservers to watch lists.