uphold-auth-io-cdn[.]pages[.]dev

The domain uphold-auth-io-cdn.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IPv6 address 2606:4700:310c::ac42:2f6a, which belongs to AS13335 (Cloudflare) and is geolocated in the United States. The site presented the page title "Suspected phishing site | Cloudflare" and returned an HTTP 403 status code before being taken offline. Security tooling flags indicate a high confidence of malicious intent: Google Safe Browsing categorises the domain as social engineering, and PhishDestroy has already blocked it. VirusTotal reports 15 of 93 scanned security vendors marking the domain as malicious, underscoring its reputational risk.

Trust metrics are extreme: Gridinsoft assigned a score of 0 out of 100, and Scamadviser gave a 1 out of 100 rating. The SSL certificate is issued by Google Trust Services under the identifier WE1, consistent with Cloudflare's default TLS provisioning. Nameservers wren.ns.cloudflare.com and stan.ns.cloudflare.com confirm the hosting relationship. The domain appears on a single known blocklist, but its presence across multiple vendor feeds and the low trust scores justify immediate containment.

At present, no additional infrastructure or payload details have been disclosed, and the exact credential‑phishing target remains unverified. Defenders should add uphold-auth-io-cdn.pages.dev to firewall deny lists, monitor for newly created Cloudflare‑registered subdomains with similar naming patterns, and correlate any authentication traffic to the domain with corporate login logs. Continuous re‑scanning of the domain and its IP range is advised to capture any re‑activation attempts.