access-upholld-us[.]pages[.]dev

This domain, access-upholld-us.pages.dev, operates as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials through fraudulent web interfaces. The infrastructure mimics legitimate authentication portals, employing social engineering tactics to trick victims into entering usernames, passwords, and potentially multi-factor authentication codes. Analysis of the domain's behavior indicates a focus on corporate or financial service impersonation, with the intent to capture and exfiltrate stolen credentials for subsequent unauthorized access or financial fraud. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on November 05, 2025, through a content delivery network provider, and resolves to the IP address 172.66.47.44, associated with autonomous system AS13335. Security vendors have flagged the domain with 12 detections out of 95 on a major threat intelligence platform, while it appears on one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), provides encrypted communication, which is commonly exploited by threat actors to lend false legitimacy to phishing sites. Additionally, the domain has been explicitly blocked by at least one specialized anti-phishing service, further corroborating its malicious classification. Users who have visited access-upholld-us.pages.dev or entered credentials on the site should immediately take corrective action to mitigate potential compromise. All exposed passwords must be changed across any accounts where the same credentials were reused, prioritizing email, financial, and corporate systems. Multi-factor authentication should be enabled or reviewed for all critical accounts, and users should monitor for unauthorized access attempts or suspicious activity. If corporate credentials were entered, internal security teams should be notified to initiate incident response protocols, including password resets and network access reviews. The domain is currently offline, but users should remain vigilant for similar phishing attempts using cloned or related infrastructure.