uphuuld-login[.]pages[.]dev

The domain uphuuld-login.pages.dev was registered on February 21, 2026 via Cloudflare, Inc. and is currently taken offline. The site presents the page title “Suspected phishing site | Cloudflare” and is classified as a credential phishing campaign. DNS resolution points to the IPv6 address 2a06:98c1:3120::3, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. The server enforces HSTS and returns HTTP 403 for the request, indicating that access is being deliberately blocked.

The TLS certificate is issued by Google Trust Services under the “WE1” label, confirming a valid HTTPS endpoint. Google Safe Browsing flags the domain for social engineering, and the Gridinsoft trust score is recorded as 0 / 100, reflecting a complete lack of trust. VirusTotal analysis shows that 14 of 95 scanned security vendors flag the domain as malicious, reinforcing the suspicion. The domain appears on one public blocklist and is listed as blocked by PhishDestroy.

Nameserver configuration uses bingo.ns.cloudflare.com and theo.ns.cloudflare.com, both Cloudflare‑operated. The combination of a recent registration, Cloudflare‑hosted infrastructure, low trust scores, multiple vendor detections, and active blocklisting indicates a high‑risk credential‑phishing operation. Defenders should add the domain and its IPv6 address to outbound allow‑list blockers, update intrusion‑prevention signatures, and monitor for any future re‑registration or similar sub‑domains on Cloudflare. Continuous threat‑intel feeds should be consulted for new detections, and any internal logs showing connections to the IPv6 address should be investigated as potential credential‑theft attempts.