login-upholdd-coeen[.]pages[.]dev

This domain, login-upholdd-coeen.pages.dev, operates as a credential harvesting site targeting users of a cryptocurrency platform. Analysis indicates the page mimics legitimate login interfaces to deceive victims into submitting account credentials, which are then exfiltrated to attacker-controlled infrastructure. The threat specifically focuses on financial account compromise, posing significant risk to users who interact with the site. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on November 06, 2025, and currently resolves to the IP address 188.114.97.3, associated with AS13335. Detection metrics show 11 out of 95 security vendors on VirusTotal flag this domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), and the page title explicitly states 'Suspected phishing site | Cloudflare,' though this may be a post-compromise indicator. Users who visited login-upholdd-coeen.pages.dev should immediately revoke any entered credentials from the legitimate service. Monitor associated accounts for unauthorized transactions or access attempts. Reset passwords using a device not previously connected to the phishing site, and enable multi-factor authentication where available. Security teams should block the domain and IP address 188.114.97.3 at network perimeters to prevent further exposure.