web-uphhold-login[.]pages[.]dev

Analysis of the domain web-uphhold-login.pages.dev indicates it was a credential phishing site targeting users through a fraudulent login page. The domain, registered on February 21, 2026, through Cloudflare, Inc., resolved to the IP address 188.114.97.3, part of AS13335 (Cloudflare, Inc.) and located in the US. The site employed Cloudflare hosting and security technologies, including HSTS and HTTP/3, alongside an SSL certificate issued by Google Trust Services (WE1). At the time of assessment, the domain returned an HTTP 403 status, with Cloudflare serving a page titled 'Suspected phishing site | Cloudflare,' suggesting automated detection and mitigation by the hosting provider.

Infrastructure analysis reveals the domain was flagged by at least one security blocklist (PhishDestroy) and assigned a trust score of 0/100 by Gridinsoft. VirusTotal records show 8 of 93 security vendors classified the domain as malicious, consistent with its designation as a credential phishing threat. The domain's nameservers (grace.ns.cloudflare.com and brett.ns.cloudflare.com) further confirm its association with Cloudflare's infrastructure. No specific brand impersonation was identified in the available data, though the domain name suggests an attempt to mimic a legitimate login portal.

The site is currently offline, likely due to Cloudflare's enforcement actions. Defenders should treat any prior traffic to this domain as indicative of credential theft attempts. Network security teams are advised to block the domain and IP address, monitor for related indicators, and review logs for connections to 188.114.97.3. Given the domain's short operational window and Cloudflare's response, further forensic evidence may be limited, but the infrastructure details remain relevant for retrospective threat hunting.