access-uphold-ui[.]pages[.]dev

access-uphold-ui.pages.dev is currently flagged as a credential‑phishing site. The domain was registered on 21 February 2026 through Cloudflare, Inc. and uses Cloudflare’s DNS infrastructure (kolton.ns.cloudflare.com, tia.ns.cloudflare.com). DNS resolution points to the IPv6 address 2606:4700:310c::ac42:2c81, which belongs to AS13335, Cloudflare, Inc., located in the United States. The site serves a page whose title reads “Suspected phishing site | Cloudflare” and returns HTTP 403, indicating that the content is being blocked or taken offline.

Transport security is provided by a Google Trust Services / WE1 certificate and the site enforces HSTS and HTTP/3, both typical of Cloudflare‑hosted services. Google Safe Browsing classifies the URL as a social‑engineering threat, and PhishDestroy has listed it on its blocklist. VirusTotal scans show that 12 of 93 security vendors have flagged the domain, reinforcing the malicious assessment. The Gridinsoft trust score of 0 / 100 further reflects a lack of legitimacy.

No additional intelligence such as OTX references or malware kits is available, and the exact phishing landing page content has not been publicly disclosed. Given the evidence, defenders should block the domain at network perimeter and DNS layers, monitor for any outbound connections to the associated Cloudflare IP range, and update endpoint protection signatures to include the 12 vendor detections. Organizations should also educate users about credential‑phishing attempts that may reference “uphold” or similar branding, even though the current page title does not reveal a specific brand target. Continuous re‑evaluation is advised in case the site is re‑hosted or the threat actor modifies the infrastructure.