upphold-logn-en[.]pages[.]dev

Uphold-Logn-EN.pages.dev was observed hosting a credential‑phishing page that returned HTTP 403 and displayed the title “Suspected phishing site | Cloudflare”. The domain was registered on 2026-02-21 through Cloudflare, Inc. and resolves to the IPv6 address 2606:4700:310c::ac42:2f41, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. Cloudflare‑provided DNS uses the authoritative nameservers rocco.ns.cloudflare.com and jamie.ns.cloudflare.com, and the site is protected by HSTS and served over HTTP/3 with a Google Trust Services / WE1 certificate. Threat‑intelligence feeds indicate that the site is classified as credential phishing and has been blocked by the PhishDestroy sinkhole. It appears on a single security blocklist and is flagged by Google Safe Browsing for social‑engineering content.

VirusTotal analysis shows that 13 of 93 scanning engines flagged the domain as malicious. The Gridinsoft trust score is 0/100, reinforcing the malicious assessment. As of the report date (2026-07-23) the domain is listed as offline and the HTTP response code is 403, suggesting that the phishing page has been taken down or is otherwise inaccessible. However, the underlying infrastructure—Cloudflare‑hosted IPv6 address, active HSTS, and valid TLS certificate—remains under the control of the same registrant, indicating that the threat actor could reactivate the site or clone the infrastructure for future campaigns.

Defenders should continue to block traffic to 2606:4700:310c::ac42:2f41 and add upphold-logn-en.pages.dev to URL filtering policies. Monitoring of the associated Cloudflare nameservers for any new sub‑domains is recommended, as is periodic re‑scanning with VirusTotal and other multi‑engine services to capture potential re‑emergence. Organizations should also educate users about credential‑phishing tactics and enforce multi‑factor authentication to mitigate credential compromise if users encounter similar lures.