get-upheld-nav[.]pages[.]dev

This domain, get-upheld-nav.pages.dev, is identified as a credential phishing site designed to harvest user login credentials through fraudulent authentication portals. Analysis indicates the domain is currently offline, though it previously operated under Cloudflare's infrastructure. No specific brand impersonation was confirmed, but the generic phishing framework suggests broad targeting of corporate or personal accounts. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on October 31, 2025, and resolved to the IP address 172.66.47.66, geolocated within the United States under AS13335 (Cloudflare, Inc.). The domain appears on one security blocklist and is flagged by 13 of 95 security vendors on VirusTotal, indicating moderate detection coverage. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious classification. Current status confirms the domain has been taken offline, likely due to enforcement actions by hosting providers or security entities. Despite its inactive state, the domain remains a residual risk for organizations with delayed blocklist updates. Recommended actions include adding the domain and associated IP (172.66.47.66) to perimeter defenses, such as DNS filters and web proxies. Security teams should review logs for connections to the domain or IP within the past 30 days to identify potential credential exposure. If brand impersonation is suspected, affected entities should initiate takedown procedures for residual artifacts.