auth-web-upholds[.]pages[.]dev

Analysis of auth-web-upholds.pages.dev indicates that the domain was created on 21 February 2026 and is hosted behind Cloudflare’s network (AS13335). DNS resolution returns the IPv6 address 2606:4700:310c::ac42:2d2c, which is associated with Cloudflare’s US edge infrastructure. The domain is registered through Cloudflare, Inc., and its authoritative nameservers are ullis.ns.cloudflare.com and weston.ns.cloudflare.com. An SSL certificate issued by Google Trust Services (WE1) is present, and the site enforces HSTS and HTTP/3, confirming the use of modern Cloudflare services.

The page title returned by the server is “Suspected phishing site | Cloudflare” and the HTTP response code is 403, indicating that the content is not publicly accessible at the time of analysis. VirusTotal reports that ten of ninety‑five scanning engines have flagged the domain, and Google Safe Browsing classifies it as a social‑engineering threat. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence in malicious intent.

The identified scam type is credential phishing, suggesting attempts to harvest user credentials. While the observable infrastructure confirms a high‑risk phishing operation, the lack of a publicly reachable page prevents verification of the exact payload or targeted brand. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat intelligence feeds with the IPv6 address and associated ASN, and monitor for any re‑registration attempts. Ongoing observation of Cloudflare‑registered subdomains and related DNS activity is recommended to detect potential re‑use of the same infrastructure.