up-heldo-official[.]pages[.]dev

Analysis of up-heldo-official.pages.dev on 29 July 2026 shows that the domain is actively flagged as a generic phishing threat. Registration is handled through Cloudflare, Inc., with authoritative nameservers bella.ns.cloudflare.com and denver.ns.cloudflare.com resolving to the IP address 188.114.97.3. The domain appears on a single security blocklist and has been blocked by the PhishDestroy service, indicating that at least one reputable anti‑phishing sinkhole has taken action against it.

VirusTotal reports that the domain was scanned by 91 vendors; none of those vendors currently list it as malicious, but the absence of detections does not constitute evidence of safety and should be weighed against the other indicators. No public Safe Browsing, OTX, or similar reputation feeds have been recorded for this domain, and there are no disclosed SSL details, HTTP status codes, trust scores, or page titles in the available intelligence. Consequently, the observable infrastructure points to a Cloudflare‑hosted site that is being used for phishing, yet the lack of additional metadata limits the depth of the assessment.

Defenders should continue to block the domain at perimeter and endpoint layers, monitor outbound connections to the associated IP address, and consider adding the domain to internal blocklists. Ongoing observation of the IP reputation and any future detection updates from scanning services is recommended, as the threat landscape may evolve and new evidence could emerge.