sec-uphold-pocet[.]pages[.]dev

The domain sec-uphold-pocet.pages.dev was created on February 21, 2026 and is currently listed as offline with an HTTP 403 response. Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative name servers are gene.ns.cloudflare.com and carl.ns.cloudflare.com, both operated by Cloudflare, which also serves as the registrar. The site presents a TLS certificate issued by Google Trust Services under the WE1 label, indicating a valid HTTPS endpoint despite the malicious intent.

Detection data from VirusTotal records twelve of ninety‑three scanning engines flagging the domain, and Google Safe Browsing classifies it as a social engineering threat. The page title returned from the server is "Suspected phishing site | Cloudflare," confirming that the content is being served from a Cloudflare‑protected endpoint. The domain appears on one public blocklist and is specifically blocked by PhishDestroy. A Gridinsoft trust score of zero further underscores the lack of benign reputation.

While the available evidence clearly identifies this domain as a credential phishing vector, details about the specific target brand or the exact phishing payload are not disclosed in the current intelligence set. Defenders should add the domain and its associated IP address to network blocklists, enforce DNS sink‑hole rules for the listed nameservers, and monitor for any residual activity that may surface from cached or CDN‑distributed copies. Continuous re‑scanning with multi‑vendor services is advised to capture any changes should the site be re‑hosted or revived.