ai-uphuld-cdn[.]pages[.]dev

The domain ai-uphuld-cdn.pages.dev was observed on July 24, 2026 and is currently offline. Registration records show the domain was created on February 21, 2026 through Cloudflare, Inc., and the authoritative nameservers are carlane.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to IP 172.66.44.199, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents the page title "Suspected phishing site | Cloudflare" and uses an SSL certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS chain. An HTTP request returned a 403 status, which is consistent with Cloudflare‑generated access denial pages. Detected technologies include HSTS, Cloudflare edge services, and HTTP/3.

Threat intelligence classifies the activity as credential phishing. The Gridinsoft trust score is 0 out of 100, and the domain appears on one security blocklist, specifically PhishDestroy. VirusTotal analysis recorded nine positive detections out of ninety‑three scanning engines, reinforcing the malicious assessment. No additional page content beyond the title has been archived, so the exact phishing vector, target brand, or credential collection method remains unknown.

Analysis indicates that the combination of a zero trust score, blocklist inclusion, multiple vendor detections, and the generic phishing page title provides sufficient confidence to label the domain as a malicious credential‑phishing host. Defenders should continue to block the domain at perimeter filters, add the associated IP address to DNS sinkhole or blacklist feeds, and monitor for any future re‑registration of the same subdomain or similar patterns under the pages.dev namespace. Because the domain is hosted on Cloudflare’s shared infrastructure, threat actors may leverage other Cloudflare‑issued subdomains, so broader scrutiny of newly registered pages.dev entries is advisable.