uphold-feq-login[.]pages[.]dev

Analysis indicates that the domain uphold-feq-login.pages.dev is currently offline but was observed serving a HTTP 403 response and presenting the page title “Suspected phishing site | Cloudflare”. The domain resolves to the Cloudflare‑managed address 188.114.96.3, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. The TLS certificate presented is issued by Google Trust Services under the “WE1” designation, confirming the use of a legitimate certificate chain despite the malicious intent. Reputation services rate the domain extremely poorly: Gridinsoft assigns a 0‑point score out of 100, and Scamadviser records a 1‑point score out of 100. VirusTotal reports that 11 of 93 scanned security vendors flagged the domain, indicating consensus among multiple AV engines that the site is malicious.

The domain appears on a single public security blocklist and is actively blocked by the PhishDestroy service. Infrastructure fingerprints show typical Cloudflare‑provided features, including enforced HSTS, support for HTTP/3, and the default Cloudflare nameservers rachel.ns.cloudflare.com and peter.ns.cloudflare.com. No additional technology stacks or third‑party services were detected beyond the Cloudflare edge. The domain was registered on 21 February 2026 through Cloudflare, Inc., and no registrar‑level abuse indicators were identified beyond the low trust scores.

Given the credential‑phishing classification, the exact target brand or service is not disclosed in the available evidence; the page title provides no further clues. Defenders should treat the domain as hostile, enforce network‑level blocks for both the domain name and the associated IP address, and add the domain to internal phishing‑URL blocklists. Continuous monitoring of newly‑created *.pages.dev subdomains is recommended, as the same infrastructure pattern may be reused.