acces-uphhold-log-in[.]pages[.]dev

This domain, acces-uphhold-log-in.pages.dev, was created on 21 February 2026 and is registered through Cloudflare, Inc. The authoritative nameservers are dax.ns.cloudflare.com and joyce.ns.cloudflare.com, indicating that the site was hosted on Cloudflare’s edge network. DNS resolution points to IP address 172.66.47.149, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The service presented an HTTPS endpoint secured by a Google Trust Services certificate (WE1) and employed HSTS and HTTP/3, consistent with Cloudflare‑provided infrastructure. An HTTP request returned a 403 status code, and the page title reported “Suspected phishing site | Cloudflare,” confirming that the content was flagged by Cloudflare’s own detection mechanisms.

The site was classified as a credential‑phishing operation and has been listed on at least one security blocklist; PhishDestroy actively blocked it. Google Safe Browsing also tags the domain for social engineering. VirusTotal analysis shows that ten of ninety‑three scanning engines flagged the domain, reinforcing the suspicion of malicious intent. Independent trust scoring from Gridinsoft assigned a rating of 0 out of 100, indicating an extremely low trust level.

As of the report date, the site is reported as taken offline, but the historical evidence suggests that the infrastructure was deliberately leveraged for phishing. Defenders should continue to block the domain, monitor the underlying IP address 172.66.47.149 for any resurgence of malicious activity, and update endpoint detection rules to include the observed certificate issuer and Cloudflare‑specific headers. Organizations that rely on credential‑based services should be aware that the domain may have been used in targeted credential‑harvesting campaigns, and user education should reinforce the risks associated with unsolicited login prompts.