eng-my-uphold-cdn[.]pages[.]dev

Analysis of eng-my-uphold-cdn.pages.dev shows a short‑lived credential‑phishing infrastructure that was taken offline prior to the report date of July 23, 2026. The domain was registered on February 21, 2026 through Cloudflare, Inc., and it resolves to the IP address 172.66.46.217, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution is served by the Cloudflare nameservers ricardo.ns.cloudflare.com and alice.ns.cloudflare.com, and the site employs modern transport features such as HTTP/3 and HTTP Strict Transport Security (HSTS). The TLS certificate presented is issued by Google Trust Services under the WE1 designation, indicating a valid, publicly trusted certificate chain.

The only page title observed is "Suspected phishing site | Cloudflare," and the HTTP response currently returned is 403, confirming that the content has been removed or blocked. Security telemetry records that PhishDestroy has blocked the domain and that it appears on a single security blocklist. VirusTotal scans show nine of ninety‑three AV engines flagging the domain, while Google Safe Browsing classifies it as a social‑engineering threat. Independent reputation scoring from Gridinsoft assigns a trust score of zero out of one hundred.

Given the observable indicators—Cloudflare hosting, a recent registration date, a low reputation score, and multiple vendor detections—defenders should continue to block the domain at perimeter devices, enforce sink‑holing of the associated IP address, and monitor for any re‑registration attempts. Ongoing observation of Cloudflare‑hosted IP ranges for similar patterns is recommended, as the infrastructure could be repurposed for future phishing campaigns.