upheld-come[.]pages[.]dev

Analysis conducted on July 23, 2026 identifies upheld-come.pages.dev as a credential‑phishing site that has been taken offline. The domain resolves to the Cloudflare‑owned address 172.66.47.25, belonging to ASN 13335 (Cloudflare, Inc.) and is hosted in the United States. DNS records point to adi.ns.cloudflare.com and karl.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The site presented the generic Cloudflare warning page “Suspected phishing site | Cloudflare”, returning HTTP status 403, and the TLS certificate was issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS configuration.

Reputation services show elevated risk: PhishDestroy has listed the domain, and a single external blocklist also marks it. VirusTotal has recorded 16 detections out of 93 scanned engines, while Gridinsoft assigned a trust score of zero out of one hundred, reflecting a strong malicious signal. No additional threat‑intel feeds (OTX, Safe Browsing, etc.) were supplied, so the broader campaign context remains unclear. The domain was registered through Cloudflare on 2 September 2020, suggesting a relatively long‑standing registration that may have been repurposed for phishing.

Because the site is currently offline, active traffic is unlikely, yet the infrastructure— Cloudflare front‑end, valid TLS, and use of HTTP/3— demonstrates a typical pattern for fast‑hosted phishing operations that can be quickly re‑activated. Defenders should continue to block the domain at perimeter and DNS layers, monitor for re‑appearance of the same host name or associated IP ranges, and consider adding the IP 172.66.47.25 to reputation‑based deny lists. Ongoing threat‑intel collection is advised to capture any future redeployment of the domain or related indicators.