home-upholld-log[.]pages[.]dev

Analysis as of July 24 2026 shows that the domain home-upholld-log.pages.dev resolves to the Cloudflare‑owned address 172.66.44.84, which is advertised as part of AS13335 in the United States. The site is served behind Cloudflare’s edge network, using HSTS and HTTP/3, and presents a Google Trust Services / WE1 SSL certificate. The page title returned by the server is “Suspected phishing site | Cloudflare”, and the HTTP response code is 403, indicating that access is currently blocked.

The domain was registered on February 21 2026 through Cloudflare, Inc., and its authoritative nameservers are ivy.ns.cloudflare.com and dom.ns.cloudflare.com. Google Safe Browsing flags the URL for social engineering, and fifteen of ninety‑five VirusTotal scanners have marked it as malicious, consistent with its classification as credential phishing. Reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100) and the domain appears on at least one public blocklist, with PhishDestroy confirming it has been taken offline.

While the infrastructure points to a typical phishing hosting pattern, the limited public visibility of the landing page prevents confirmation of the exact credential‑harvesting technique. Defenders should continue to block the domain at network perimeter, monitor for any residual DNS queries, and consider adding the IP 172.66.44.84 to threat‑intel feeds. Ongoing observation of Cloudflare‑hosted subdomains is advised, as the provider may host additional malicious sites under the same IP range.