en-portal-uphold-com[.]pages[.]dev

The domain en-portal-uphold-com.pages.dev is suspected of credential theft and is currently offline. This domain was likely used to trick users into divulging sensitive information such as usernames and passwords.

Analysis indicates that the domain was flagged by 11 of 95 VirusTotal vendors, suggesting a moderate level of consensus among security researchers regarding its malicious intent. The domain is registered through Cloudflare, Inc. and resolves to the IP address 172.66.47.94, which is located in the United States and is part of AS13335 Cloudflare, Inc. The domain was created on October 30, 2025, and appears on 1 security blocklist. The SSL certificate for the domain is issued by Google Trust Services / WE1, which may have been used to lend an air of legitimacy to the site.

Given the current status of the domain being taken offline, the immediate threat has been mitigated. However, users who may have accessed the site before it was taken down should monitor their accounts for any unauthorized activity. Security teams are advised to continue monitoring for any resurrection of the domain and to update their blocklists and threat intel databases accordingly. Additionally, users should be educated on the signs of phishing attacks and the importance of verifying the legitimacy of websites before entering any sensitive information.