info-upholds-com-web[.]pages[.]dev

Analysis of the domain info-upholds-com-web.pages.dev indicates that it was registered through Cloudflare on 21 February 2026. The authoritative nameservers are rayne.ns.cloudflare.com and mike.ns.cloudflare.com, and DNS resolution points to 172.66.44.206, an IP owned by AS13335 Cloudflare, Inc., located in the United States. The site presented a valid SSL certificate issued by Google Trust Services under the WE1 hierarchy, and the connection employed HSTS and HTTP/3, confirming modern transport security. An HTTP request returned status code 403, and the page title returned by the server reads “Suspected phishing site | Cloudflare”.

Threat intelligence classifies the activity as credential phishing, and the domain is currently listed on a single security blocklist. PhishDestroy has taken the site offline, and the overall Gridinsoft trust score is 0 out of 100, reflecting a high‑risk assessment. VirusTotal scans show that 10 of 93 antivirus or URL‑reputation engines flagged the domain, providing independent corroboration of malicious intent. The combination of a recent registration date, use of Cloudflare’s edge infrastructure, a low trust score, and multiple vendor detections suggests a deliberately short‑lived phishing campaign.

At this time the actual payload, targeted brand, or victim‑facing page content has not been disclosed, and no additional indicators such as malware hashes or command‑and‑control endpoints are available. Defenders should continue to block the domain at perimeter and DNS filtering layers, monitor for any outbound connections to the IP 172.66.44.206, and treat any credential submissions to this host as compromised. Because the domain is already offline, retrospective analysis of web traffic logs may reveal exposure; organizations that observed HTTP 403 responses or the specific page title should flag those events as malicious and consider user credential reset procedures where applicable.