uphld-loggin[.]pages[.]dev

The domain uphld-loggin.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and immediately points to Cloudflare’s network (ASN 13335) with the IP address 172.66.47.180 located in the United States. DNS resolution uses the Cloudflare authoritative nameservers lamar.ns.cloudflare.com and magali.ns.cloudflare.com, and the site served an HTTP 403 response, indicating that the content is currently blocked or taken offline. The SSL certificate presented is issued by Google Trust Services under the WE1 identifier, confirming the use of a valid TLS chain but providing no authentication of the underlying content. Google Safe Browsing has flagged the URL for social engineering, and the domain appears on a single external security blocklist, corroborated by an explicit block by PhishDestroy.

VirusTotal analysis shows that 12 of 93 scanning engines flagged the domain, reinforcing the malicious classification. Gridinsoft assigned a trust score of 0 out of 100, and the page title returned by the server is “Suspected phishing site | Cloudflare,” matching the credential‑phishing type reported in the intelligence. Detected technologies include HSTS, Cloudflare’s edge services, and HTTP/3, which are typical for fast‑response malicious infrastructure.

While the content has been taken offline, the observed infrastructure—public Cloudflare hosting, a valid Google‑signed certificate, and rapid blocklist inclusion—suggests a disposable credential‑phishing operation that could be re‑hosted under a different sub‑domain. Defenders should continue to block the DNS name, monitor for any re‑appearance of similar sub‑domains on the same IP range, and correlate logs for outbound connections to 172.66.47.180. Updating web filtering rules to include the domain and its associated IP, enforcing multi‑factor authentication, and educating users about social‑engineering cues are recommended mitigations.