supportupholds[.]pages[.]dev

Analysis of supportupholds.pages.dev indicates that the domain was registered on 21 February 2026 through Cloudflare, Inc. and is served from Cloudflare's network (ASN 13335, United States). DNS resolution points to 172.66.47.119, which belongs to Cloudflare's edge infrastructure. The site presents the page title “Suspected phishing site | Cloudflare” and returns an HTTP 403 status code, indicating that the content is being blocked or restricted. The TLS certificate is issued by Google Trust Services under the WE1 certificate profile, confirming a valid HTTPS endpoint but not implying legitimacy of the hosted content. Threat intelligence sources classify the site as a tech‑support scam.

Google Safe Browsing labels the URL as a social‑engineering threat, and nine out of ninety‑three VirusTotal scanners have flagged the domain as malicious. The domain is listed on one external blocklist and is actively blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The nameservers miguel.ns.cloudflare.com and collins.ns.cloudflare.com are standard Cloudflare delegations.

The observable evidence aligns with a typical infrastructure used for credential‑harvesting or remote‑access scams, where the attacker exploits the reputable Cloudflare and Google TLS chains to evade simple reputation checks. No additional content analysis is available because the site has been taken offline as of the report date, limiting further behavioural observation. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole entries, and monitor for any re‑use of the underlying IP address or similar Cloudflare‑hosted subdomains. Ongoing collection of threat intelligence on related tech‑support scam campaigns is advised.