uphuld-loginn[.]pages[.]dev

The domain uphuld-loginn.pages.dev was registered through Cloudflare, Inc. on February 21, 2026 and resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are april.ns.cloudflare.com and kianchau.ns.cloudflare.com. The site presented the page title “Suspected phishing site | Cloudflare” and is classified as credential phishing. VirusTotal scanned the domain and 14 of 93 security vendors reported it as malicious. The domain appears on a single public blocklist and is specifically listed by PhishDestroy.

An HTTPS connection is served with a certificate issued by Google Trust Services under the WE1 label, and the server advertises HSTS and HTTP/3 support. Trust‑rating services assign extremely low scores: Scamadviser 1/100 and Gridinsoft 0/100. The HTTP response returned a 403 status code, and the current operational status is offline. Analysis indicates that the infrastructure relies on Cloudflare’s edge network, which masks the true origin of the phishing infrastructure while providing a valid TLS certificate. The low trust scores and the blocklist entry corroborate the malicious classification.

The presence of a page title referencing Cloudflare’s “Suspected phishing site” page suggests that the domain was identified and taken down by Cloudflare’s automated abuse mechanisms. The limited detection footprint—only one blocklist and 14 vendor flags—means that broader visibility may be limited, but the existing indicators are sufficient for defensive actions. Defenders should add the IP address 188.114.96.3 and the full domain name to network‑level deny lists, monitor DNS queries for the associated nameservers, and ensure that web‑proxy and email filters reference the Cloudflare blocklist entry. Continuous re‑scanning on VirusTotal or equivalent services is advised to capture any future changes in vendor detection.