learn-upholld-auth[.]pages[.]dev

This domain presents an elevated risk as it was configured for credential theft, specifically targeting users through a fraudulent authentication page designed to harvest login credentials. The site was hosted on Cloudflare's infrastructure and has been taken offline after being flagged by security systems.

Technical indicators paint a clear picture of malicious intent. VirusTotal analysis shows 10 out of 95 security vendors flagged the domain as malicious. The domain was registered on October 31, 2025 through Cloudflare, Inc., and resolved to IP address 172.66.44.224. An SSL certificate from Google Trust Services (WE1) was issued, lending a false sense of legitimacy. The domain appears on one security blocklist, and the page title now displays "Suspected phishing site | Cloudflare," confirming it was intercepted by Cloudflare's own security measures. The domain's creation date is very recent, which is common for phishing operations.

Users who may have encountered this site should immediately change any credentials entered on the page and enable two-factor authentication on affected accounts. Since this is a credential theft phishing attempt, monitoring for unauthorized access attempts is advised. Security teams should ensure that email filters and web gateways are updated to block this domain and similar patterns. The domain is now offline, but related domains may appear; vigilance against unsolicited authentication prompts is recommended.