start-uphhold-login[.]pages[.]dev

Analysis of start-uphhold-login.pages.dev shows that the domain was registered on February 21 2026 through Cloudflare, Inc. and is currently hosted on Cloudflare’s network (IP 172.66.44.154, AS13335, United States). The site presents a Cloudflare‑generated page titled “Suspected phishing site | Cloudflare” and returns HTTP 403, indicating that the content has been taken offline. Despite the offline status, multiple security services have already flagged the domain. Scamadviser assigns a trust score of 1 out of 100 and Gridinsoft reports a score of 0 out of 100. The domain appears on at least one public phishing blocklist and is specifically listed by PhishDestroy as a credential‑phishing threat.

VirusTotal scans show that 15 of 93 AV engines label the domain as malicious, reinforcing the suspicion. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming that HTTPS is correctly configured but does not mitigate the underlying abuse. Detected technologies include HSTS, HTTP/3, and Cloudflare’s edge services, all of which are consistent with the hosting provider’s default stack. The page title and the classification “Credential Phishing” are the only content‑level indicators available; no further page‑level artifacts have been captured because the site is offline.

Uncertainty remains regarding the exact phishing campaign infrastructure, such as the target brand or the credential‑capture mechanism, as no landing page content or URL paths have been observed. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑activation, and add the IP address 172.66.44.154 to threat‑intel feeds. Because the domain is hosted on a shared Cloudflare network, additional scrutiny of other domains sharing the same IP may be warranted. Organizations employing web‑filtering or Safe Browsing services should ensure that start‑uphhold‑login.pages.dev is included in their deny lists to prevent accidental user exposure.