gat-upholdd-app[.]pages[.]dev

Analysis of gat-upholdd-app.pages.dev indicates a high‑risk credential phishing operation. The domain, created on 2026-02-21, is registered through Cloudflare, Inc. and resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare in the United States. HTTP responses return a 403 status code, and the site enforces HSTS and supports HTTP/3, suggesting a modern web stack. The SSL certificate presented is issued by Google Trust Services under the WE1 identifier, confirming the use of a valid TLS certificate.

Multiple intelligence sources flag the domain as malicious: it appears on one security blocklist, is blocked by PhishDestroy, and Google Safe Browsing categorises it as social engineering. Reputation services assign extremely low scores, with Scamadviser reporting 1/100 and Gridinsoft 0/100. VirusTotal analysis shows that 11 of 93 security vendors have flagged the domain, reinforcing the suspicion of phishing activity. The page title "Suspected phishing site | Cloudflare" explicitly labels the content as a suspected phishing site.

Nameservers elizabeth.ns.cloudflare.com and clint.ns.cloudflare.com further confirm Cloudflare hosting. While the site is currently offline, defenders should continue to block the domain at network perimeter and DNS layers, monitor for any reappearance, and consider sinkholing the associated IP address. Additional investigation of the payload, if the site reactivates, would be required to determine the exact credential harvesting mechanisms.