us-en-upholdd-login[.]pages[.]dev

Analysis of the domain us-en-upholdd-login.pages.dev shows a credential‑phishing infrastructure that was created on 21 February 2026 and is currently taken offline. The site returned HTTP 403 and the page title presented by the server is “Suspected phishing site | Cloudflare”, indicating that Cloudflare’s automated blockpage was triggered. DNS resolution points to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is registered through Cloudflare, Inc. and uses the Google Trust Services / WE1 SSL certificate, enforcing HSTS and supporting HTTP/3, both common in legitimate Cloudflare‑hosted services.

Reputation data is poor: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reports that 12 of 93 scanning engines flagged it as malicious. The nameservers collins.ns.cloudflare.com and carmelo.ns.cloudflare.com are standard Cloudflare endpoints, offering no additional attribution.

While the precise phishing landing page content has not been examined, the combination of a Cloudflare blockpage, low trust score, multiple vendor detections, and the credential‑phishing classification suggests an active attempt to harvest user credentials. Defenders should continue to block the domain at network perimeters, monitor for any resurgence of the host or related subdomains, and consider adding the IP address 188.114.97.3 to deny lists. Ongoing threat‑intel feeds should be consulted for any new detections, and users should be reminded to verify URLs before entering credentials, especially for services that do not match the expected domain.