nav-upheld-login-us[.]pages[.]dev

Analysis of nav-upheld-login-us.pages.dev, created on February 21, 2026, indicates a credential phishing operation that has been taken offline as of the report date, July 24, 2026. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.110, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presented a HTTP 403 response and the page title returned by the server is "Suspected phishing site | Cloudflare," confirming that Cloudflare has flagged the content as malicious. Infrastructure checks reveal that the domain employs HSTS, HTTP/3, and a TLS certificate issued by Google Trust Services under the WE1 root, indicating a modern HTTPS configuration typical of legitimate services but frequently leveraged by malicious actors to gain user trust.

A Gridinsoft trust score of 0 out of 100 further underscores the high risk associated with the domain. Eight of ninety‑five security vendors on VirusTotal flagged the domain, and it appears on at least one external security blocklist, demonstrating consensus among threat intelligence sources. The domain is also listed by PhishDestroy as a blocked phishing site. Nameserver records point to evelyn.ns.cloudflare.com and ryan.ns.cloudflare.com, both Cloudflare‑controlled, reinforcing the reliance on Cloudflare’s DNS and edge services.

While the page title and blocklist entries provide concrete evidence of phishing intent, no additional content analysis or brand‑specific targeting details are available. Defenders should enforce network‑level deny rules for the domain and its associated IP, monitor DNS queries for the listed nameservers, and consider adding the domain to endpoint and web‑gateway allow‑lists for blocking. Continuous re‑evaluation is advised in case the site is re‑hosted or the threat actor reactivates the domain under a new configuration.