now-uphld-us[.]pages[.]dev

This domain, now-uphld-us.pages.dev, is flagged as a high-risk credential phishing site. Created on February 21, 2026, the domain is registered through Cloudflare, Inc. and currently resolves to the IP address 172.66.47.57, which is located in the United States and is part of AS13335, Cloudflare, Inc. The site is currently offline, returning an HTTP status code 403, and is blocked by PhishDestroy. The page title, 'Suspected phishing site | Cloudflare,' indicates that the domain has been identified and flagged by Cloudflare's security systems. Analysis of the domain's infrastructure reveals the use of HSTS, Cloudflare, and HTTP/3 technologies, which are often employed to enhance the credibility and security of phishing sites.

The domain's SSL certificate is issued by Google Trust Services, further suggesting an attempt to appear legitimate. Both Gridinsoft and Scamadviser have assigned the domain very low trust scores of 0/100 and 1/100, respectively, indicating a high level of suspicion. Google Safe Browsing has flagged the domain for social engineering, a common tactic in credential phishing attacks.

Despite the domain being taken offline, it appears on one security blocklist, suggesting that it was previously active and may have been used in phishing campaigns. Defenders should remain vigilant and ensure that their systems and users are aware of the risks associated with this domain. Regular monitoring and updating of security measures are recommended to prevent any potential resurgence of phishing activities.