nav-upheld-com-eng[.]pages[.]dev

nav-upheld-com-eng.pages.dev is flagged as a credential‑phishing site. The domain was registered on February 21 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 188.114.96.3, which is part of AS13335 in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 name, indicating that HTTPS is correctly terminated but does not imply legitimacy of the hosted content. An HTTP request returned status 403 and the page title reported by the server is “Suspected phishing site | Cloudflare”, which is Cloudflare’s own interstitial page for blocked resources. The site advertised HSTS and HTTP/3, both typical of Cloudflare‑served traffic.

Google Safe Browsing categorises the domain as social‑engineering, and VirusTotal recorded detections from 14 of 93 scanning engines, reinforcing the malicious classification. The domain appears on a single public blocklist and has been explicitly blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 / 100, reflecting extreme risk. The overall risk level is listed as high, and the current operational status is offline. Evidence does not disclose the exact phishing landing page or targeted brand; the only visible artifact is the Cloudflare warning page.

Because the domain is hosted on a shared Cloudflare infrastructure, any mitigation must focus on the domain name rather than the IP address, which also serves many legitimate sites. Defenders should add the fully‑qualified domain to URL filtering and DNS blocklists, monitor for re‑registration, and consider threat‑intel sharing with peers. Continuous observation of the associated IP range for new malicious activity is advised. Until the domain is reclaimed by the legitimate owner, it should be treated as a high‑severity credential‑phishing indicator.