offical-uphuld-com--x[.]pages[.]dev

Analysis of the domain offical-uphuld-com--x.pages.dev shows a short‑lived credential‑phishing infrastructure that was taken offline before the report date of July 23, 2026. The domain was registered on February 21, 2026 through Cloudflare, Inc., and is hosted on Cloudflare’s network (AS13335) with the IPv6 address 2606:4700:310c::ac42:2ca8 located in the United States. DNS resolution points to the Cloudflare nameservers kenneth.ns.cloudflare.com and abby.ns.cloudflare.com, and the site served a HTTP 403 response protected by HSTS and HTTP/3. The SSL certificate presented is issued by Google Trust Services under the WE1 designation, confirming the use of a legitimate certificate chain.

The page title returned by the server is "Suspected phishing site | Cloudflare," matching the declared scam type of credential phishing. Reputation checks indicate a Gridinsoft trust score of 0 / 100 and Google Safe Browsing flags the URL for social engineering. VirusTotal recorded 13 detections out of 93 scanners, and the domain appears on a single security blocklist, where it was also blocked by PhishDestroy. The combined evidence suggests the domain was actively used for credential collection before being seized or otherwise disabled.

Uncertainty remains around the specific target brand or credential set harvested, as no landing‑page content or lure details have been disclosed. Defenders should continue to block the IPv6 address and associated Cloudflare nameservers at perimeter defenses, monitor for any re‑use of the same sub‑domain pattern, and ensure that endpoint protection solutions incorporate the VirusTotal detection signatures. Threat‑intel feeds should be updated to reflect the offline status, but analysts should remain vigilant for future deployments that may reuse similar Cloudflare‑hosted infrastructure.