uphold-app-com[.]pages[.]dev

The domain uphold-app-com.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and currently resolves to the Cloudflare edge address 172.66.47.16, which is associated with ASN AS13335 in the United States. The site presents a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1) and enforces HSTS while supporting HTTP/3. An HTTP request returns status code 403, and the only visible page title is "Suspected phishing site | Cloudflare". Reputation services indicate extreme risk: Scamadviser assigns a trust score of 1 out of 100, Gridinsoft scores 0 out of 100, and the domain appears on one security blocklist.

VirusTotal analysis shows 14 of 93 scanners flag the domain as malicious, confirming a consensus of detection among multiple vendors. The domain is also listed by PhishDestroy as blocked. The technical footprint suggests the domain is being used for credential phishing, although the specific target brand or credential collection page has not been observed beyond the generic title. Because the site is hosted behind Cloudflare, direct attribution of the underlying server is obscured, and the content has not been captured since the site is presently offline.

Defenders should immediately deny DNS resolution for uphold-app-com.pages.dev, add the IP 172.66.47.16 to network blocklists, and monitor for any sub‑domains or similarly named assets registered under the same Cloudflare nameservers (sage.ns.cloudflare.com, maya.ns.cloudflare.com). Continuous re‑scanning with VirusTotal and inclusion in URL filtering policies are recommended to capture any future re‑activation. The limited exposure window and the presence on multiple threat intel sources merit an elevated risk posture until the domain remains offline and no further malicious payloads are observed.