homepage-upheld[.]pages[.]dev

Analysis of homepage-upheld.pages.dev indicates a credential phishing infrastructure hosted on Cloudflare Pages, first registered on February 21, 2026. The domain currently returns an HTTP 403 status with a page title explicitly labeled 'Suspected phishing site | Cloudflare,' suggesting internal detection by the hosting provider prior to takedown. SSL inspection reveals a certificate issued by Google Trust Services (WE1), while HTTP Strict Transport Security (HSTS) and HTTP/3 protocols are enforced, consistent with modern phishing kits attempting to appear legitimate. The domain resolves to 188.114.96.3 (AS13335, Cloudflare, Inc., US) and is managed via Cloudflare nameservers (dalary.ns.cloudflare.com, ian.ns.cloudflare.com).

Google Safe Browsing classifies this domain under 'social engineering,' and it appears on at least one security blocklist. VirusTotal reports 14 detections from 93 security vendors, though the specific payload or targeted brand remains unconfirmed in available data. Gridinsoft assigns a trust score of 0/100, reinforcing high-risk classification.

The domain was flagged by PhishDestroy and subsequently taken offline, though residual DNS records may persist. Defenders should treat this infrastructure as compromised, revoke any associated credentials, and monitor for related domains leveraging similar Cloudflare Pages naming conventions (e.g., '*-upheld.pages.dev'). Further investigation into the kit's distribution method is recommended, as the exact phishing lure and targeted sector are not yet determined from observable evidence.