help-uphlld-secure-io[.]pages[.]dev

The domain help-uphlld-secure-io.pages.dev was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the IP address 172.66.47.53, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a page title of "Suspected phishing site | Cloudflare" and currently returns an HTTP 403 status code, indicating that access is denied. An SSL certificate issued by Google Trust Services (WE1) secures the connection, but the presence of a valid certificate does not mitigate the malicious intent indicated by other indicators. Google Safe Browsing flags the domain for social engineering, and VirusTotal reports that 13 of 95 security vendors have flagged the domain as malicious.

The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. Reputation services assign extremely low scores: Gridinsoft scores 0 out of 100 and Scamadviser scores 1 out of 100, reflecting a high confidence in the domain’s malicious nature. Detected technologies include HSTS, Cloudflare edge services, and HTTP/3, confirming that the infrastructure is leveraged to provide fast, encrypted delivery. While the exact credential targets are not disclosed in the available data, the classification as credential phishing suggests attempts to harvest user credentials.

Uncertainties remain regarding the specific brand or service being impersonated, as no brand name appears in the page title or other provided metadata. Defenders should immediately block the domain at network perimeter devices, update DNS filtering policies to deny resolution of help-uphlld-secure-io.pages.dev, and incorporate the observed indicators—IP address 172.66.47.53, the Cloudflare nameservers sue.ns.cloudflare.com and kellen.ns.cloudflare.com, and the Google Safe Browsing social engineering flag—into threat‑intel platforms.