uphld-secure-en[.]pages[.]dev

This domain is flagged as an active credential phishing site targeting users of a cryptocurrency and digital asset exchange platform. The site mimics the official login portal, presenting a page titled 'Log In | Uphold® | Buy & Sell Crypto & Metals' to deceive visitors into entering their account credentials, which are then harvested by threat actors. Such stolen credentials can lead to unauthorized access to digital wallets, financial theft, and further exploitation of linked services, including cryptocurrency transactions and personal data exposure. Analysis indicates the domain was registered through Cloudflare Pages and created on April 1, 2026, an unusually future-dated registration that may suggest domain spoofing or an attempt to evade detection timelines. The site resolves to the IP address 172.66.47.72, located in California and associated with Cloudflare’s infrastructure. Despite its deceptive appearance, the domain has not yet been widely flagged, with only 0 out of 95 security engines on VirusTotal detecting it as malicious at the time of assessment. It appears on one security blocklist, indicating early but limited awareness of its fraudulent nature. Users who have visited uphld-secure-en.pages.dev or entered credentials on the site should immediately take protective actions. Cease all interaction with the domain and revoke any active sessions on the legitimate platform. Change passwords for the affected account and any other services where the same credentials may have been reused. Enable multi-factor authentication if not already active. Monitor account activity for unauthorized transactions or logins, and report any suspicious behavior to the legitimate service provider. Consider using a password manager to generate and store unique credentials for each online service to prevent cross-account compromise.