upholdd-view-cdnn[.]pages[.]dev

Analysis of upholdd-view-cdnn.pages.dev indicates that the domain was created on 21 February 2026 and is hosted behind Cloudflare’s network. DNS resolution returns the address 172.66.44.177, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The authoritative nameservers are ruben.ns.cloudflare.com and imani.ns.cloudflare.com, confirming that the domain is fully managed by Cloudflare. An HTTP request to the site returns a 403 status code and the page title “Suspected phishing site | Cloudflare”, a generic warning page displayed by Cloudflare when a domain is identified as a phishing host. Reputation services consistently rate the domain as hostile.

Google Safe Browsing classifies it under social‑engineering, PhishDestroy has already taken the site offline, and the domain appears on at least one security blocklist. Scamadviser assigns a trust score of 1 / 100 and Gridinsoft reports 0 / 100, both indicating extreme distrust. VirusTotal scans show that ten of ninety‑three AV engines raise a malicious detection, reinforcing the suspicion. The SSL certificate presented is issued by Google Trust Services under the WE1 profile, which is typical for Cloudflare‑protected sites but does not mitigate the underlying phishing intent. The declared scam type is credential phishing, meaning the domain is likely used to harvest login credentials.

No additional evidence about the specific target brand or the exact phishing page content is available; the only observed indicator is the Cloudflare warning page. Defenders should continue to block all traffic to the domain, monitor DNS queries for the resolved IP, and ensure that any email or web filters reference its reputation indicators. Because the site is already offline, the immediate threat is reduced, but the infrastructure – shared Cloudflare IP space and the same nameserver configuration – could be reused for future malicious domains.