faq-uphled-logi[.]pages[.]dev

Analysis of the domain faq-uphled-logi.pages.dev indicates it was a credential phishing site operating under Cloudflare Pages infrastructure. The domain, registered through Cloudflare, Inc. on February 21, 2026, resolved to the IP address 172.66.47.198 (AS13335, Cloudflare, Inc., US-based). At the time of assessment, the domain returned an HTTP 403 status with a page title explicitly labeled 'Suspected phishing site | Cloudflare,' suggesting internal detection by the hosting provider. The SSL certificate was issued by Google Trust Services (WE1), and the site employed security technologies such as HSTS and HTTP/3, likely inherited from Cloudflare’s default configurations. The domain appeared on one security blocklist and was flagged by 6 of 95 security vendors in VirusTotal scans, confirming its classification as malicious.

Gridinsoft assigned a trust score of 0/100, further corroborating its phishing designation. The scam type was explicitly identified as credential phishing, though the specific brand or service targeted remains unconfirmed due to the absence of detailed page content analysis. Detection by PhishDestroy and the domain’s subsequent takedown align with standard responses to confirmed phishing activity. Defenders should treat this domain as a confirmed phishing threat, particularly given its credential harvesting classification.

The use of Cloudflare Pages infrastructure is notable, as it may complicate attribution and takedown efforts due to the platform’s ephemeral hosting model. Monitoring for related domains under the same registrar or IP range (172.66.47.0/24) is recommended, as threat actors frequently reuse hosting providers. The domain’s nameservers (dimitris.ns.cloudflare.com and eve.ns.cloudflare.com) may also serve as indicators for future campaigns. While the site is currently offline, historical DNS and WHOIS records should be preserved for forensic analysis if required.