upphold-wallet[.]pages[.]dev

Analysis of the domain upphold-wallet.pages.dev confirms its classification as a crypto drainer phishing site, currently offline as of July 23, 2026. The domain was registered through Cloudflare, Inc. on February 21, 2026, and resolves to the IP address 172.66.46.235, associated with AS13335 (Cloudflare, Inc.) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (audrey.ns.cloudflare.com, gabe.ns.cloudflare.com) and technologies including HSTS, Cloudflare security layers, and HTTP/3. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains.

The domain is flagged by 12 of 93 security vendors on VirusTotal, indicating detection by multiple engines, though the specific signatures or heuristics triggering these alerts are not detailed in available intelligence. It appears on a single security blocklist, specifically PhishDestroy, and has been assigned trust scores of 0/100 by Gridinsoft and 1/100 by ScamAdviser, reflecting near-universal consensus on its malicious nature. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its classification, as Cloudflare’s interstitial warnings are automatically applied to domains exhibiting phishing indicators. At the time of this report, the domain returns an HTTP 403 status, suggesting it has been taken offline or restricted by the hosting provider.

While the exact content of the site is not analyzed, the scam type is explicitly labeled as a 'Crypto Scam' in available intelligence, aligning with the domain name's implied association with cryptocurrency wallet services. Defenders should treat this domain as confirmed malicious and prioritize blocking it at the DNS, proxy, and endpoint levels. Network logs should be reviewed for any prior connections to 172.66.46.235 or the domain itself, particularly in environments where cryptocurrency transactions occur.