help-up-hold-io[.]pages[.]dev

The domain help-up-hold-io.pages.dev was created on 2020-09-02 and is currently listed as offline with an HTTP 403 response. Its infrastructure is hosted behind Cloudflare, using the IP address 188.114.97.3 belonging to AS13335 Cloudflare, Inc., and it resolves through the Cloudflare nameservers adi.ns.cloudflare.com, karl.ns.cloudflare.com, maleah.ns.cloudflare.com, and norman.ns. The site presented a TLS certificate issued by Google Trust Services under the WE1 label, while HTTP headers indicate the use of HSTS and HTTP/3. The page title observed in previous scans reads “Login to Uphold | Manage Your Crypto & Assets Safely,” which aligns with a wallet/seed phishing campaign that impersonates Google.

Google Safe Browsing has flagged the domain for social-engineering, and PhishDestroy has added it to its blocklist. VirusTotal recorded 14 detections out of 93 scanners, and a Gridinsoft trust score of 0 / 100 further confirms its malicious nature. The domain is registered through Cloudflare, Inc., and appears on one additional security blocklist. Analysis confirms the domain’s primary purpose is brand impersonation targeting Google users to harvest cryptocurrency wallet seeds.

Concrete evidence includes the malicious page title, the Google-issued TLS certificate, and the detection counts from VirusTotal and Gridinsoft. Uncertainty remains regarding any post-offline activity, the exact phishing payload, and whether additional infrastructure such as command-and-control servers or data exfiltration endpoints is associated with the domain, as no open-source threat‑intel or malware‑kit identifiers were observed. Defenders should immediately block the domain and its associated IP range at perimeter defenses, update URL‑filtering and email‑security policies to reject any traffic to help-up-hold-io.pages.dev, and monitor for similar Cloudflare‑hosted domains that use Google Trust Services certificates.