help-uphld-uss[.]pages[.]dev

The domain help-uphld-uss.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network (IP 172.66.44.247, AS13335, United States). The site presents a Cloudflare‑issued HTTPS certificate signed by Google Trust Services / WE1 and enforces HSTS while supporting HTTP/3. An HTTP request returns a 403 status code and the page title is “Suspected phishing site | Cloudflare.” Google Safe Browsing classifies the URL as social engineering, and 11 of 93 VirusTotal scanners have flagged it, indicating a consensus among security vendors that the domain is malicious.

The Gridinsoft trust score of 0 / 100 further corroborates its low reputation. The domain appears on one security blocklist and has been actively blocked by PhishDestroy. The observed scam type is credential phishing, though the specific target or credential collection page has not been disclosed.

Current operational status is offline, suggesting the infrastructure has been taken down or is no longer serving content. Defenders should immediately deny any outbound connections to 172.66.44.247, add the domain to DNS and proxy blocklists, and monitor for any re‑registration attempts or related subdomains within the same Cloudflare account. Continuous vigilance is advised because the underlying hosting provider can provision new IPs rapidly, and similar phishing campaigns often reuse the same registrar and certificate authority.