pages-upholds-en-us[.]pages[.]dev

This domain, pages-upholds-en-us.pages.dev, was identified as a credential phishing infrastructure active under Cloudflare hosting. Registered on February 21, 2026, through Cloudflare, Inc., it resolved to IP 172.66.44.116 (AS13335, US) and employed security technologies including HSTS and HTTP/3, alongside a Cloudflare-issued SSL certificate from Google Trust Services (WE1). As of July 24, 2026, the domain returned an HTTP 403 status, with the page title explicitly labeled 'Suspected phishing site | Cloudflare,' indicating automated detection by the hosting provider. Analysis reveals the domain was flagged by 12 of 93 security vendors on VirusTotal, though the specific detection context remains unverified.

Google Safe Browsing classified the site as engaging in social engineering, and it appeared on at least one security blocklist. Trust scores from Gridinsoft (0/100) and Scamadviser (1/100) further corroborate its malicious classification. The domain was taken offline, and PhishDestroy lists it as blocked. Defenders should treat this domain as confirmed phishing infrastructure, particularly targeting credential theft.

While the exact brand impersonation is not specified in available data, the 'upholds' substring suggests potential targeting of financial or cryptocurrency services. No evidence of a phishing kit or additional payloads was provided. Network defenders are advised to block the domain, IP, and associated nameservers (jewel.ns.cloudflare.com, andy.ns.cloudflare.com) at perimeter controls, and review logs for prior connections from internal assets. Given the domain's registration recency and Cloudflare hosting, monitoring for re-emergence under similar subdomains or IPs within AS13335 is recommended.