upholdlogi-acoaaunt[.]pages[.]dev

Analysis of upholdlogi-acoaaunt.pages.dev shows a high‑risk credential phishing operation that was taken offline as of the report date, July 24 2026. The domain was registered on February 21 2026 through Cloudflare, Inc., and resolves to the IPv6 address 2606:4700:310c::ac42:2c9d, which belongs to AS13335 Cloudflare in the United States. Infrastructure fingerprints include HSTS, Cloudflare front‑end services and HTTP/3 support, indicating the site leveraged Cloudflare’s edge network for anonymity and performance. The SSL certificate presented is issued by Google Trust Services under the WE1 identifier, a common certificate for Cloudflare‑hosted sites.

The page title returned by the server is “Suspected phishing site | Cloudflare” and the HTTP response code is 403, suggesting the content was blocked or unavailable at the time of access. Google Safe Browsing flags the domain for social engineering, and it appears on one public security blocklist. VirusTotal analysis records ten detections out of ninety‑three scanned security vendors, reinforcing the malicious classification. Additional reputation signals include a Gridinsoft trust score of 0 / 100 and a designation by PhishDestroy as a credential phishing site.

The domain’s current status is offline, but its recent creation date and the presence on multiple detection platforms indicate a recent, opportunistic campaign. Defenders should continue to block the domain and its associated IPv6 address at network perimeters, add the domain to internal URL filtering and threat‑intel feeds, and monitor for any re‑registration attempts. Continuous observation of Cloudflare‑associated nameservers (arnold.ns.cloudflare.com and lina.ns.cloudflare.com) is advised, as threat actors often exploit the same hosting infrastructure for future campaigns.