logiin-uphld-otth[.]pages[.]dev

Analysis of logiin-uphld-otth.pages.dev indicates that the domain was created on February 21, 2026 and is hosted on Cloudflare infrastructure (AS13335, United States). The site resolved to IP address 172.66.45.10 and presented an HTTPS service secured by a Google Trust Services / WE1 certificate, with HSTS and HTTP/3 enabled. The HTTP response returned a 403 status code, and the page title reported by the server was "Suspected phishing site | Cloudflare," consistent with a takedown page rather than active content. Google Safe Browsing classified the domain as a social engineering threat, and VirusTotal recorded 13 detections out of 93 scanned security vendors, reinforcing the malicious assessment.

The domain appears on a single external blocklist and is actively blocked by PhishDestroy. Additional reputation data show a Gridinsoft trust score of 0 / 100, indicating a lack of benign reputation. Nameservers listed were frida.ns.cloudflare.com and dylan.ns.cloudflare.com, both owned by Cloudflare. The documented scam type is credential phishing, targeting login credentials.

While the site is currently offline, the observable infrastructure—Cloudflare‑provided SSL, HSTS, HTTP/3, and the observed blocklist entries—suggests a deliberately provisioned phishing staging environment. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation or related subdomains, and incorporate the IP address 172.66.45.10 into threat‑intel feeds. Ongoing vigilance is advised because the underlying Cloudflare hosting can be rapidly re‑provisioned, potentially enabling future phishing campaigns.