sso-uphlld-io-docs[.]pages[.]dev

The domain sso-uphlld-io-docs.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network, as indicated by its authoritative nameservers (clara.ns.cloudflare.com, milan.ns.cloudflare.com) and its resolution to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 label, confirming that HTTPS is enforced. An HTTP request to the root URL returns a 403 status code and the page title "Suspected phishing site | Cloudflare," suggesting that the content has been taken down or blocked by Cloudflare’s protective mechanisms.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis shows that 10 of 93 security vendors have flagged the domain, and Google Safe Browsing classifies it as a social engineering threat. The Gridinsoft trust score of 0 / 100 further reflects a malicious reputation.

The combination of recent creation, Cloudflare‑based hosting, a low‑trust SSL context, HTTP 403 response, and multiple vendor detections aligns with a credential‑phishing operation. Although the site is currently offline, defenders should continue to enforce network‑level blocks for the domain and its associated IP address, monitor for any re‑activation, and incorporate the indicator set into phishing‑detection rules. Ongoing vigilance is advised given the high risk rating and the observed malicious indicators.