gateway-uphlld-en[.]pages[.]dev

The domain gateway-uphlld-en.pages.dev is a confirmed generic phishing site designed to steal user credentials through credential phishing tactics. No specific brand or drainer kit was impersonated, and the site has since been taken offline. Users who visited gateway-uphlld-en.pages.dev may have been exposed to fraudulent login requests aimed at harvesting sensitive information.

Technical analysis shows that gateway-uphlld-en.pages.dev was flagged by 1 of 95 VirusTotal security vendors, including Trustwave, and was actively blocked by Google Safe Browsing for 'SOCIAL_ENGINEERING'. The domain was registered through Cloudflare, Inc. on February 21, 2026, and resolved to the IP address 172.66.47.192, hosted on Cloudflare's US infrastructure (AS13335). It appeared on one security blocklist (PhishDestroy) and used an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'Suspected phishing site | Cloudflare', and the HTTP status returned was 403. Technologies detected included HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100.

Users who may have interacted with gateway-uphlld-en.pages.dev should immediately change passwords for any accounts accessed during the exposure period, enable two-factor authentication (2FA) where available, and monitor accounts for unauthorized activity. Reporting the domain to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities can help prevent further abuse. If financial or cryptocurrency credentials were entered, additional steps such as revoking token approvals or transferring funds to a new wallet may be necessary.