sso-upholden[.]pages[.]dev

Analysis of sso-upholden.pages.dev shows a high‑risk credential phishing infrastructure that has been taken offline as of the report date, July 23, 2026. The domain was registered through Cloudflare, Inc. on February 21, 2026 and resolves to the IP address 172.66.44.151, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution uses the Cloudflare nameservers lara.ns.cloudflare.com and margo.ns.cloudflare.com, and the site served an HTTPS certificate issued by Google Trust Services under the WE1 label, indicating a valid TLS chain. HTTP responses returned a 403 status code, and the page title presented by the server is "Suspected phishing site | Cloudflare," confirming that the host was flagged by Cloudflare's own detection mechanisms.

Technical headers reveal the presence of HSTS and HTTP/3, both typical of Cloudflare‑protected services. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy. Google Safe Browsing classifies the URL as social engineering, and VirusTotal reports that ten of ninety‑three scanning engines have flagged the domain, reinforcing the phishing assessment. Gridinsoft assigns a trust score of zero out of one hundred, further indicating malicious intent.

While the offline status prevents active probing, the observed indicators—credential phishing classification, blocklist inclusion, multiple vendor detections, and a zero trust score—suggest a coordinated attempt to harvest user credentials. Defenders should continue to enforce URL filtering for sso-upholden.pages.dev, monitor for any re‑registration or resurrection of the domain, and ensure that endpoint protection solutions are updated to reflect the ten VirusTotal detections. Organizations using Cloudflare‑based services should verify that legitimate subdomains are not inadvertently shadowed by malicious clones and consider employing DNS‑based allowlists to reduce exposure to similar abuse vectors.