action-kash-upzold-web-legiz-auth[.]pages[.]dev

The domain action-kash-upzold-web-legiz-auth.pages.dev was registered on February 21, 2026 and is currently taken offline, as indicated by a 403 HTTP response and confirmation that PhishDestroy has blocked the site. Infrastructure analysis shows the domain resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain is hosted behind Cloudflare, using HSTS and HTTP/3, and the SSL certificate is issued by Google Trust Services under the WE1 authority. The page title returned by the server is "Suspected phishing site | Cloudflare," confirming the site was flagged by Cloudflare’s own mitigation system.

A Gridinsoft trust score of 0 out of 100 further underscores the malicious nature of the host. Detection engines on VirusTotal flagged the domain in 11 of 93 security vendor scans, and Google Safe Browsing lists it as a social‑engineering threat. The name servers listed are jaime.ns.cloudflare.com and gloria.ns.cloudflare.com. The domain appears on at least one public security blocklist and has been explicitly blocked by the PhishDestroy takedown service.

While the specific credential‑phishing payload or targeted brand is not disclosed in the available intelligence, the combination of a low trust score, multiple vendor detections, and Cloudflare’s own phishing warning provides strong evidence of credential‑phishing activity. Defenders should continue to block the domain at the DNS level, monitor the associated IP for any future re‑use, and ensure that email and web security gateways reference the current blocklist entries. Ongoing surveillance of Cloudflare‑hosted infrastructure is advised, as the attacker could attempt to relocate the phishing campaign to a new subdomain or IP within the same provider network.