uphood-login[.]pages[.]dev

The domain uphood-login.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.44.167, which is advertised as belonging to AS13335 Cloudflare in the United States. The site presented the page title "Suspected phishing site | Cloudflare" and returned an HTTP 403 status code when accessed. SSL termination is performed by a Google Trust Services / WE1 certificate, and the host advertises HSTS, Cloudflare services, and HTTP/3 support. Reputation checks show a Gridinsoft trust score of 0 out of 100, indicating an extremely low confidence rating.

VirusTotal analysis recorded detections by 10 of 93 security vendors, and the domain appears on a single external blocklist. PhishDestroy has actively blocked the host, confirming its classification as a credential phishing vector. The nameservers in use are walk.ns.cloudflare.com and dale.ns.cloudflare.com. As of the report date, July 24, 2026, the domain is listed as offline, but its recent creation date and the observed malicious indicators suggest a short‑lived phishing campaign targeting credential harvest.

Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the host or related subdomains, and correlate internal logs for outbound connections to the IP 172.66.44.167. Because the site employed Cloudflare’s edge services, threat actors may leverage the same infrastructure for future campaigns, so broader Cloudflare IP ranges should be considered for heightened scrutiny. Ongoing threat‑intel feeds should be consulted for any updates on additional detections, and security teams should ensure that endpoint protection solutions are updated to reflect the 10 vendor detections reported by VirusTotal.