discover-upheld[.]pages[.]dev

Analysis of the domain discover-upheld.pages.dev indicates it was actively flagged as a credential phishing threat prior to being taken offline. The domain, registered through Cloudflare, Inc. on February 21, 2026, resolved to the IP address 172.66.44.131, which is part of Cloudflare’s network (AS13335) located in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (anderson.ns.cloudflare.com and maxine.ns.cloudflare.com), along with security technologies such as HSTS and HTTP/3, which are consistent with modern web hosting but do not preclude malicious use. At the time of assessment, the domain returned an HTTP 403 status, and its page title was explicitly labeled 'Suspected phishing site | Cloudflare,' a clear indicator of its compromised or malicious status.

The domain appears on at least one security blocklist, and seven out of ninety-three security vendors on VirusTotal flagged it as malicious, reinforcing its classification as a phishing threat. Gridinsoft assigned a trust score of 0/100, further corroborating its high-risk designation. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the domain’s malicious intent, as certificates are routinely issued to both legitimate and fraudulent sites. No specific brand impersonation or phishing kit details were provided in the available evidence, so the exact content of the phishing page remains unconfirmed.

However, the scam type is explicitly categorized as credential phishing, suggesting the site was designed to harvest login credentials. Defenders should treat this domain as a confirmed threat, particularly in environments where credential theft poses a significant risk. While the domain is currently offline, organizations are advised to monitor for any reactivation attempts and block the domain and associated IP address (172.66.44.131) at the network level as a precautionary measure.