uphold--login-io[.]pages[.]dev

The domain uphold--login-io.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is delegated to the Cloudflare authoritative name servers bart.ns.cloudflare.com and maya.ns.cloudflare.com. DNS resolution points to IP address 172.66.47.150, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1), and the HTTP response currently returns a 403 status code, indicating that the host is refusing direct access. Security telemetry shows that eight of ninety‑three VirusTotal scanners have flagged the domain, and it appears on at least one external blocklist. The Gridinsoft trust score is recorded as 0 out of 100, reflecting an extremely low confidence rating. The page title returned by the server is "Suspected phishing site | Cloudflare," and the service has been classified as a credential‑phishing operation. Additional infrastructure observations include the use of HTTP/3, enforced HSTS, and the standard Cloudflare edge‑network stack.

Analysis indicates that the domain’s infrastructure is fully hosted on Cloudflare’s edge platform, a common choice for malicious actors seeking rapid deployment and built‑in DDoS mitigation. The low trust score, combined with multiple vendor detections and the presence on a blocklist, reinforces the assessment that the domain is being used to harvest user credentials. The current offline status, as reported by PhishDestroy, suggests that the site has been taken down, but the underlying registration and hosting details remain active and could be repurposed for future campaigns.

Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any re‑registration or changes to the underlying IP address.