up-hold-login-en-usa[.]pages[.]dev

The domain up-hold-login-en-usa.pages.dev was created on February 21, 2026 and is currently taken offline. It is registered through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to Cloudflare's AS13335 network located in the United States. The site presents the page title "Suspected phishing site | Cloudflare" and has been blocked by the PhishDestroy blocklist. Cloudflare services are observed, including HSTS enforcement and HTTP/3 support, indicating the infrastructure is fully protected by the provider's edge network.

SSL termination is performed by Google Trust Services under the "WE1" certificate, confirming a valid TLS certificate but not mitigating the phishing intent. The domain's Gridinsoft trust score is 0 out of 100, reflecting a highly untrusted status. On VirusTotal, thirteen of ninety‑three security vendors flagged the domain as malicious, reinforcing the suspicion of credential phishing activity. Google Safe Browsing categorises the site as social engineering, and the HTTP response returned a 403 status code, suggesting the content is being actively blocked or restricted.

The domain appears on a single security blocklist and is classified explicitly as a credential phishing scam. While the available data confirms malicious infrastructure and multiple vendor detections, the exact phishing payload, target brand, or victim interaction flow remains unknown because no page content beyond the title has been captured. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the host, and update detection rules to incorporate the observed IP address, Cloudflare nameservers (nash.ns.cloudflare.com, sky.ns.cloudflare.com), and the specific page title fingerprint. Ongoing vigilance is recommended given the recent creation date and the active involvement of multiple security vendors.