eu-uphuld-loginn[.]pages[.]dev

Analysis of the domain eu-uphuld-loginn.pages.dev indicates a high-risk phishing campaign impersonating Google, as documented on July 23, 2026. The domain, registered through Cloudflare, Inc. on February 21, 2026, resolves to the IP address 172.66.44.90, which is hosted on Cloudflare's infrastructure (AS13335) in the United States. The domain's nameservers, april.ns.cloudflare.com and kianchau.ns.cloudflare.com, further confirm its association with Cloudflare's hosting services. At the time of investigation, the domain returned an HTTP 403 status, and its page title was explicitly flagged by Cloudflare as 'Suspected phishing site,' aligning with its classification as a brand impersonation threat.

Google Safe Browsing has categorized this domain under 'social engineering,' a designation consistent with phishing activity. Detection by security vendors remains limited but notable: the domain appears on one blocklist (PhishDestroy), and 15 of 93 security vendors on VirusTotal have flagged it as malicious. Trust scores from Scamadviser and Gridinsoft both reflect extreme risk, with ratings of 1/100 and 0/100, respectively. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the domain's malicious intent, as phishing sites frequently employ valid certificates to appear legitimate.

Infrastructure analysis reveals the use of modern web technologies, including HSTS and HTTP/3, which may be leveraged to evade detection or enhance perceived credibility. The domain's current offline status suggests takedown action, though defenders should remain vigilant for potential re-emergence under similar naming conventions or infrastructure. Organizations are advised to block the domain and its resolved IP (172.66.44.90) at the network level, monitor for related indicators of compromise, and educate users on recognizing brand impersonation tactics.