up-holdlogin--sso[.]pages[.]dev

The domain up-holdlogin--sso.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 188.114.97.3 (AS13335, United States). The site presents the page title “Suspected phishing site | Cloudflare” and returns an HTTP 403 status code. TLS negotiation uses a certificate issued by Google Trust Services / WE1, and the connection is protected by HSTS and HTTP/3, indicating a modern Cloudflare deployment. Reputation checks show mixed signals: VirusTotal records 12 detections out of 95 scanned engines, and Google Safe Browsing classifies the domain as a social‑engineering threat.

Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single public blocklist, currently blocked by PhishDestroy. The nameservers rachel.ns.cloudflare.com and peter.ns.cloudflare.com confirm the Cloudflare hosting configuration. The infrastructure has been taken offline, and the current status is reported as “offline”.

Analysts should continue to monitor the IP address 188.114.97.3 for any re‑use in future credential‑phishing campaigns, and ingest the indicator into URL filtering and email security policies. Because the page content has not been publicly captured, the exact credential‑collection mechanism remains unknown, but the combination of a Cloudflare‑hosted domain, a low trust score, and multiple vendor detections strongly suggests a credential‑phishing operation. Defensive actions include adding the domain to blocklists, enforcing TLS inspection, and alerting users to avoid any unsolicited login prompts that reference the domain.