eng-upheld-app[.]pages[.]dev

Analysis of eng-upheld-app.pages.dev shows that the domain resolves to the IP address 172.66.47.101 and is served through Cloudflare’s infrastructure, as indicated by the authoritative nameservers conrad.ns.cloudflare.com and paislee.ns.cloudflare.com. Registration information lists Cloudflare, Inc. as the registrar, which is consistent with the use of Cloudflare’s DNS and CDN services for rapid provisioning of malicious sites. The domain appears on a single security blocklist and is explicitly listed by the PhishDestroy blocklist, confirming that at least one external threat‑intel feed has flagged it as malicious.

VirusTotal has processed the domain with 91 scanning engines; none of these engines currently report a detection, but the lack of a positive result does not constitute evidence of safety and should be interpreted as a lack of current signatures rather than a clean bill of health. No public Safe Browsing, Open Threat Exchange, SSL certificate details, HTTP response codes, trust‑score metrics, page title, or direct evidence links have been disclosed, leaving those vectors unverified at this time. Defenders should therefore treat the domain as a potential phishing host and incorporate it into blocklists at the network perimeter, DNS filtering, and endpoint security layers.

Continuous monitoring of the IP address 172.66.47.101 for changes in reputation, as well as periodic re‑scans on VirusTotal or similar platforms, is advised. Organizations should also review outbound traffic logs for connections to this domain or its resolved IP, and consider enforcing multi‑factor authentication to mitigate credential compromise should users inadvertently interact with the site. The current risk posture remains under investigation, and further intelligence collection is required to determine the specific brand or service the site may be impersonating.