en--uphold-login[.]pages[.]dev

Analysis of en--uphold-login.pages.dev as of July 29, 2026, confirms its classification as an active credential phishing domain targeting Uphold users. The domain is hosted on Cloudflare infrastructure, resolving to IP address 172.66.44.154, and utilizes Cloudflare nameservers armfazh.ns.cloudflare.com and harmony.ns.cloudflare.com. Registration details indicate the domain was provisioned through Cloudflare, Inc., a common choice for phishing operators due to its free hosting and privacy features. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, indicating prior detection by multiple threat intelligence platforms.

VirusTotal telemetry shows 14 of 91 security vendors flagging the domain as malicious, providing additional corroboration of its phishing function. While the exact content of the site has not been analyzed, the subdomain structure ('en--uphold-login') strongly suggests an intent to deceive users into submitting credentials under the guise of an Uphold login portal. Defenders should treat this domain as high-risk.

Recommended actions include blocking the domain at DNS and proxy levels, adding the IP 172.66.44.154 to network deny lists, and alerting users to avoid interaction. Given Cloudflare's role as both registrar and hosting provider, takedown requests should be directed through Cloudflare's abuse reporting channels. No additional brand impersonation or scam category details are available from current intelligence, and further analysis of the site's content is required to confirm specific phishing techniques or payloads.