up-hold-walett[.]pages[.]dev

up-hold-walett.pages.dev was observed in early 2026 and is currently offline. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.47.123, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. The authoritative nameservers are lola.ns.cloudflare.com and santino.ns.cloudflare.com, confirming that the domain is hosted behind Cloudflare’s CDN and benefits from HSTS and HTTP/3 support. The site presented a single page whose title was “Suspected phishing site | Cloudflare”, and the SSL certificate was issued by Google Trust Services under the WE1 root, indicating a valid TLS handshake.

Multiple security vendors have classified the domain as a credential‑phishing site. VirusTotal records show that 10 of 95 scanning engines flagged the domain, and Google Safe Browsing lists it as a social‑engineering threat. PhishDestroy and an additional unnamed blocklist have already blocked the domain, and it appears on one public security blocklist. Reputation services assign extremely low scores: Scamadviser 1/100 and Gridinsoft 0/100.

The HTTP response returned a 403 status code, which is consistent with Cloudflare’s default block page for suspected malicious content. No further content was captured before the site was taken offline, so the exact phishing lure, targeted brands, or credential‑collection mechanisms remain unknown. Analysts should continue to monitor the IP address and associated Cloudflare edge nodes for any re‑use, update intrusion‑detection signatures with the observed domain, IP, and SSL fingerprint, and ensure that endpoint protection solutions block URLs matching the recorded page title. Organizations using Google Safe Browsing or similar feed should keep the domain on their block lists, and any email filters should flag messages containing links to the “pages.dev” sub‑domain as high‑risk until the infrastructure is fully retired.