begin-upholld-logn[.]pages[.]dev

Analysis of the domain begin-upholld-logn.pages.dev shows a short‑lived infrastructure that was registered on 21 February 2026 through Cloudflare, Inc. The domain resolves to the IP address 188.114.97.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. DNS resolution uses the Cloudflare authoritative name servers dax.ns.cloudflare.com and joyce.ns.cloudflare.com, confirming that the attacker leveraged Cloudflare’s hosting platform for anonymity and rapid deployment. The site presented the page title “Suspected phishing site | Cloudflare” and is classified as a credential‑phishing operation. HTTPS is provided by a Google Trust Services / WE1 certificate, and the connection enforces HTTP Strict Transport Security and HTTP/3, indicating a modern TLS configuration despite the malicious intent. When accessed, the server returned HTTP 403, which is consistent with Cloudflare’s default block page for taken‑down or restricted content.

The domain appears on a single security blocklist and is actively blocked by PhishDestroy. Independent scanning on VirusTotal recorded detections from ten of ninety‑five security vendors, reinforcing the malicious assessment. Google Safe Browsing has flagged the URL for social‑engineering, and Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating. The current operational status is “offline,” suggesting that the phishing page has been removed or the hosting has been terminated.

However, the underlying registration and hosting details remain active, allowing a potential re‑use of the same infrastructure. Uncertainty remains regarding the specific brand or service being impersonated, as the page title and available intelligence do not disclose a target victim brand. Defenders should therefore treat the domain as high‑risk and implement immediate blocking at network perimeter and DNS layers.