app-iuphold-login[.]pages[.]dev

Analysis of app-iuphold-login.pages.dev indicates a high‑risk credential phishing operation that has been taken offline as of the report date, July 25, 2026. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.47.69, associated with ASN 13335 (Cloudflare, Inc.) in the United States. DNS resolution is served by the authoritative name servers sunny.ns.cloudflare.com and anirban.ns.cloudflare.com, confirming the use of Cloudflare’s hosting infrastructure. HTTP requests to the site return a 403 status code, and the page title returned by the server is "Suspected phishing site | Cloudflare," which aligns with the observed classification. The site presents a valid TLS certificate issued by Google Trust Services under the WE1 root, indicating that HTTPS is correctly configured despite the malicious intent.

Multiple defensive feeds have flagged the domain. Google Safe Browsing lists it under social engineering, and PhishDestroy has actively blocked it. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme malicious confidence. VirusTotal reports ten detections out of ninety‑three scanned security vendors, reinforcing the consensus that the domain is being used for credential harvesting. The site appears on one additional security blocklist, further corroborating its malicious status.

Technical indicators such as enforced HSTS, support for HTTP/3, and the Cloudflare‑provided CDN suggest an attempt to obscure origin infrastructure and improve reliability for phishing distribution. While the exact credential capture mechanism cannot be confirmed without page content, the combination of a targeted domain name, reputable SSL certificate, and multiple independent detections provides sufficient evidence for classification as a credential phishing site.