auth-uphud-docs[.]pages[.]dev

On July 24, 2026 the domain auth-uphud-docs.pages.dev was identified as a credential‑phishing infrastructure that has been taken offline. The site was provisioned through Cloudflare, Inc., with the domain registration timestamp of February 21, 2026. DNS resolution points to the Cloudflare edge IP 188.114.96.3, located in the United States and announced by ASN 13335, confirming that the hosting is provided by Cloudflare’s network. The domain is served over HTTPS using a Google Trust Services / WE1 certificate and enforces HSTS, while the underlying web stack advertises HTTP/3 support.

The page title returned by the server is "Suspected phishing site | Cloudflare", and the HTTP response code is 403, indicating that the content is no longer publicly accessible. Threat intelligence sources have recorded the domain on a single blocklist and it is actively blocked by the PhishDestroy service. VirusTotal analysis shows that 7 of 93 scanned security vendors flagged the domain, reinforcing the malicious assessment. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating.

Nameserver configuration lists lady.ns.cloudflare.com and achiel.ns.cloudflare.com, both standard Cloudflare authoritative servers. The observed evidence points to a credential‑phishing campaign, though the specific target brand or credential type has not been disclosed beyond the generic classification. Defenders should add auth-uphud-docs.pages.dev to URL filtering rules, block the associated Cloudflare IP address range if not already covered, and monitor for any resurgence of the domain or related subdomains. Continuous re‑query of VirusTotal and blocklist feeds is advised to capture any future detections, and any inbound traffic from the listed nameservers should be scrutinized for anomalous patterns.